https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:09:28 +0000 https://vulnerability.circl.lu/vuln/cve-2026-70650 <p><strong>Affected:</strong> GetSimpleCMS-CE</p> <p>GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page&#39;s Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page&#39;s backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.</p> <p><strong>Affected:</strong> GetSimpleCMS-CE</p> <p>GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page&#39;s Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page&#39;s backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.</p> https://vulnerability.circl.lu/vuln/cve-2026-70650