CyberRota Analysis
AI-GeneratedGetSimple CMS versions 3.3.22 and earlier are vulnerable to stored Cross-Site Scripting (XSS) through the "Theme to Components" functionality, allowing attackers to inject and execute arbitrary JavaScript in the administrative interface. This vulnerability poses a significant risk as it can lead to unauthorized actions and data exposure within the admin panel. Organizations using affected versions should prioritize remediation efforts, especially those managing sensitive content or user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.