Description (CNA)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GetSimpleCMS-CE / GetSimpleCMS-CE | affected <= 3.3.22 |
CWE
CWE-79
References
ADP enrichment
No English description supplied.