Getsimple Cms
CVE-2026-28495
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSRF page
-
DeliveryLure logged-in admin to visit page
-
ExploitSubmit gsconfig editor form without CSRF token
-
ExecutionOverwrite gsconfig.php with PHP code
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | GetSimple CMS v3.3.22 with massiveAdmin plugin v6.0.3 bundled and enabled; target admin must be authenticated and visit attacker-controlled page; gsconfig editor module must lack CSRF token validation |
| Impact | CVSS 9.6 with PoC. CSRF against CMS admin panels can lead to complete site takeover. |
| Exploit ScenarioDerived | An attacker creates a malicious webpage that, when visited by a GetSimple CMS admin, performs administrative actions like creating new admin accounts or modifying site content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
GetSimple CMS massiveAdmin plugin has a CSRF vulnerability enabling attackers to perform admin actions through crafted malicious pages.
Earlier versions of this analysis (1)
CSRF in GetSimple CMS massiveAdmin plugin enables unauthorized admin actions.
RemediationAI
Update the plugin. Implement CSRF tokens on all state-changing operations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The massiveAdmin plugin v6.0.3 for GetSimple CMS has a CWE-352 CSRF vulnerability that allows attackers to perform administrative actions by tricking an admin into visiting a malicious page.
Know when Getsimple Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.
Executive ViewAI
A critical vulnerability in GetSimple CMS allows authenticated administrators to inject malicious code into core configuration files, potentially compromising the entire web application and underlying infrastructure. Organizations running GetSimple CMS v3.3.22 face immediate risk of data breach, website defacement, and operational disruption if administrator accounts are compromised or misused.
Disable or uninstall the massiveAdmin plugin immediately if not essential to operations. Restrict administrative panel access to specific IP addresses/VPN only. Implement Web Application Firewall rules to block POST/PUT requests to gsconfig.php files. Enforce multi-factor authentication on all administrator accounts. Monitor file integrity of gsconfig.php for unauthorized modifications. Consider migrating to actively maintained CMS platforms with regular security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
More in Getsimple Cms
View allGetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user
An issue was discovered in GetSimple CMS through 3.3.15. Rated critical severity (CVSS 9.8), this vulnerability is remot
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete
An issue was discovered in GetSimple CMS v3.3.13. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Unauthenticated attackers can access sensitive files in GetSimple CMS when Apache's AllowOverride directive is disabled,
Arbitrary file read vulnerability in GetSimple CMS affects all versions through its Uploaded Files feature, allowing una
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpa
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. Rated medium severity (CVSS 6.1), this vulnera
Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background managem
GetSimple CMS allows authenticated users to upload SVG files containing malicious JavaScript through the administrative
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Rated medium severity (CVSS 5.4),
Exploit-DB