CVE-2023-6188

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	GetSimpleCMS	3.3.16; 3.4.0a

References

https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352Exploit
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1358Exploit
https://vuldb.com/?ctiid.245735Permissions Required
https://vuldb.com/?id.245735Third Party Advisory
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352Exploit
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1358Exploit
https://vuldb.com/?ctiid.245735Permissions Required
https://vuldb.com/?id.245735Third Party Advisory

Timeline

Published: Nov 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-61895.3Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using CVE-2023-61909.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Inf CVE-2023-61919.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Inj CVE-2023-61935.3quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excess CVE-2023-61947.1In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) r CVE-2023-61954.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5 CVE-2023-61968.8The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due CVE-2023-61975.4The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due CVE-2023-61989.3Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access CVE-2023-61996.5Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.CVE-2023-62007.5A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an CVE-2023-62018.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama