#Date: 12/10/2015 #Discovered by: Joel Vadodil Varghese #Type of vulnerability: Reflected XSS #Tested on: Windows 8.1 #Product: GetSimple CMS #Version: 3.3.7 #Description: Application is vulnerable to Reflected XSS attack. There is a reflected XSS issue in the "uploads" section in version 3.3.7. When we pass the payload in the folder name section the payload gets executed and the folder gets created. Notified Vendor: October 12, 2015 Response: October 12, 2015 Closure of the security bug: Version 3.3.8 Reference: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1103 (Vendor Confirmation) Thanks, Joel V