[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-56660":6},{"stargazers_count":4,"fetched_at":5},8,"2026-10-01T21:17:52.676Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":101,"aliases":102,"duplicate_of":9,"upstream":103,"downstream":104,"duplicates":105,"related":106,"reserved_at":9,"published_at":107,"modified_at":108,"state":109,"summary":110,"references_raw":117,"kevs":124,"epss":9,"epss_history":125,"metrics":126,"affected":134},"CVE-2026-56660","GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.",null,[11,36,91],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-352","Cross-Site Request Forgery (CSRF)","The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","weakness","Stable","Compound","Medium",[20,24,28,32],{"id":21,"name":22,"techniques":23},"CAPEC-111","JSON Hijacking (aka JavaScript Hijacking)",[],{"id":25,"name":26,"techniques":27},"CAPEC-462","Cross-Domain Search Timing",[],{"id":29,"name":30,"techniques":31},"CAPEC-467","Cross Site Identification",[],{"id":33,"name":34,"techniques":35},"CAPEC-62","Cross Site Request Forgery",[],{"_key":37,"id":37,"name":38,"description":39,"type":15,"status":40,"abstraction":41,"likelihood_of_exploit":18,"capec":42},"CWE-434","Unrestricted Upload of File with Dangerous Type","The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.","Draft","Base",[43],{"id":44,"name":45,"techniques":46},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[47],{"id":48,"name":49,"tactics":50,"countermeasures":66},"T1574.010","Services File Permissions Weakness",[51,54,57,60,63],{"id":52,"name":53},"TA0110","Persistence",{"id":55,"name":56},"TA0111","Privilege Escalation",{"id":58,"name":59},"TA0030","Defense Evasion",{"id":61,"name":62},"TA0005","Stealth",{"id":64,"name":65},"TA0104","Execution",[67,72,77,82,86],{"id":68,"name":69,"tactic":70},"D3-RS","Restore Software",{"name":71},"Restore",{"id":73,"name":74,"tactic":75},"D3-SWI","Software Inventory",{"name":76},"Model",{"id":78,"name":79,"tactic":80},"D3-SBV","Service Binary Verification",{"name":81},"Detect",{"id":83,"name":84,"tactic":85},"D3-AVE","Asset Vulnerability Enumeration",{"name":76},{"id":87,"name":88,"tactic":89},"D3-SU","Software Update",{"name":90},"Harden",{"_key":92,"id":92,"name":93,"description":94,"type":15,"status":95,"abstraction":41,"likelihood_of_exploit":9,"capec":96},"CWE-918","Server-Side Request Forgery (SSRF)","The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","Incomplete",[97],{"id":98,"name":99,"techniques":100},"CAPEC-664","Server Side Request Forgery",[],[],[],[],[],[],[],"2026-10-01T19:37:46.187Z","2026-10-01T19:54:11.631Z","Deferred",{"cisa_kev":111,"cisa_ransomware":111,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":112,"severity_score":113,"severity_version":114,"severity_source":115,"severity_vector":116,"severity_status":109},false,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",[118],{"url":119,"sources":120,"tags":122},"https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-q5rx-gppg-768r",[115,121],"nvd",[123],"X Refsource CONFIRM",[],[],[127,132],{"source":115,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":128,"cvss_v4_0":9},{"baseScore":113,"baseSeverity":129,"vectorString":116,"impactScore":130,"exploitabilityScore":131},"CRITICAL",10,5.9,{"source":121,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":133,"cvss_v4_0":9},{"baseScore":113,"baseSeverity":129,"vectorString":116,"impactScore":130,"exploitabilityScore":131},[135],{"ecosystem":9,"name":136,"vendor":137,"product":137,"cpe_part":138,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":139},"GetSimpleCMS-CE","getsimplecms-ce","a",[140],{"version":141,"is_range":142,"range_type":115,"version_start":9,"version_start_type":9,"version_end":143,"version_end_type":144,"fixed_in":9},"\u003C 1.5",true,"1.5","excluding"]