Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
How I discovered CVE-2026–27147 — Stored XSS | Cyber Tamarin https://medium.com/p/how-i-discovered-cve-2026-27147-stored-xss-cyber-tamarin-c5ff993a3062?source=social.tw
Post summary
The Medium post announces the discovery of CVE‑2026‑27147, a stored XSS flaw, but does not provide a PoC, exploit code, active exploitation reports, or patch information.
https://cybertamarin.medium.com/how-i-discovered-cve-2026-27147-stored-xss-cyber-tamarin-c5ff993a3062
Post summary
The Medium article reports the discovery of CVE-2026-27147, a stored XSS vulnerability, providing technical details and a PoC, but does not mention active exploitation, patches, or false positives.
CVE-2026-27147 GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files v… https://www.cve.org/CVERecord?id=CVE-2026-27147
Post summary
CVE-2026-27147 affects all GetSimple CMS versions, allowing XSS via authenticated SVG file uploads; no PoC, exploit, active exploitation, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | getsimple-ce | getsimple_cms | - | - | - |