GetSimple CMS CE CVE-2026-53953

Requires a reachable GetSimple CMS CE 3.3.22 admin panel and that the attacker know (or enumerate) a valid existing username, since the reset only acts on existing users. Exploitation hinges on two product-specific conditions both present by design in this version: the password reset endpoint is accessible without authentication, and the admin login endpoint enforces neither rate limiting nor account lockout, enabling online testing of candidate passwords. The limiting factors are the need to predict/narrow the microtime()-seeded rand() value for the reset moment and to sustain enough login attempts to hit the correct candidate; submitting the reset also overwrites the legitimate admin's password, which is noisy and may alert defenders.

This is a genuine high-priority issue despite the absence of exploitation telemetry. The CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H) reflects a network-reachable, unauthenticated flaw, and the mechanics support that: an attacker can invoke the password reset endpoint anonymously and then brute-force the weakly-generated temporary password online because the admin login enforces no rate limiting or lockout. The core weakness (CWE-338, PHP rand() seeded with microtime()) meaningfully shrinks the keyspace, which raises practical exploitability. However, no EPSS score, KEV listing, or POC was provided in the input - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation yet. I would argue the input's AC:L is slightly optimistic: real exploitation requires predicting/narrowing the microtime()-based seed and sustaining an online guessing campaign, which is closer to AC:H in practice (verify against a working PoC). The most urgent aggravating factor is that no patch exists at publication, leaving no vendor remediation path; this elevates operational risk for anyone running 3.3.22. Net: a real priority for any exposed GetSimple CMS CE admin panel, tempered only by the product's limited deployment footprint.

An unauthenticated attacker submits a password reset request for a known admin username against an internet-exposed GetSimple CMS CE 3.3.22 instance, forcing the application to generate and store a new temporary password derived from PHP rand() seeded with microtime(). The attacker then generates the constrained set of candidate passwords for the reset time window and tests them against the admin login endpoint, which has no rate limiting or lockout, until one succeeds and grants administrator access. No public exploit was identified at time of analysis, so this would require custom tooling.