CVE-2026-53953

waiting for further signals

GHSA-vvhx-56q2-gcjq ↗EUVD-2026-91043 ↗

no check availablenot proven exploitable

cve.orgpublic poc−112dkev

GetSimpleCMS-CE 3.3.22

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

ETK-2026-302, permanent identifier

cvss9.1cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

19d 11h 49msince last run

39mAI analysis

timeline

0 = trigger signal

public poc−3.7motrigger signal (cve.org) +0mowaiting for further signals+0.0mo

−3mo

−2mo

−1mo

description

GetSimpleCMS-CE 3.3.22 allows unauthenticated password-reset requests that produce insufficiently unpredictable temporary passwords for existing accounts. An attacker able to access the reset and administrator login interfaces may test candidates online and take over an administrator account because login attempts are not throttled or locked out.

mitigation

Restrict access to the password-reset and administrator login interfaces, and enforce rate limiting and account lockout for login attempts. Monitor reset activity and administrator authentication attempts; no fixed version is recorded.

check

exploit

automation

–

auth required

EPSS

0.34%26th percentile

agent run time

39m

cve.org record, t = 0

2026-10-01 19:36Z

Δ to public poc

−112d

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-06-11 17:25Z
public poc
https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vvhx-56q2-gcjq
2026-10-01 19:36Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-53953

this entry in the feed

GET /api/v1/feed/CVE-2026-53953

{
  "etk_id": "ETK-2026-302",
  "cve_id": "CVE-2026-53953",
  "display_id": "CVE-2026-53953",
  "ghsa_id": "GHSA-vvhx-56q2-gcjq",
  "euvd_id": "EUVD-2026-91043",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Predictable password reset in GetSimpleCMS-CE",
  "summary": "GetSimpleCMS-CE 3.3.22 allows unauthenticated password-reset requests that produce insufficiently unpredictable temporary passwords for existing accounts. An attacker able to access the reset and administrator login interfaces may test candidates online and take over an administrator account because login attempts are not throttled or locked out.",
  "mitigation": "Restrict access to the password-reset and administrator login interfaces, and enforce rate limiting and account lockout for login attempts. Monitor reset activity and administrator authentication attempts; no fixed version is recorded.",
  "vendor": "GetSimpleCMS-CE",
  "product": "GetSimpleCMS-CE",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "3.3.22"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "GetSimpleCMS-CE/GetSimpleCMS-CE",
      "purl": null
    }
  ],
  "cwes": [
    338
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0034,
  "epss_percentile": 0.2642,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 38.5029045,
  "t0_at": "2026-10-01T19:36:17.930000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-06-11T17:25:17+00:00",
      "days": -112.09098298611111,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T19:36:17.930000+00:00",
      "url": "https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vvhx-56q2-gcjq"
    },
    "trigger_signal": {
      "at": "2026-10-01T19:36:17.930000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T19:36:17.930000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53953"
    }
  }
}

published 2026-10-02 05:26Z
last change 2026-10-21 15:05Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.