CVE-2016-20054
CVE-2016-20054 · Nodcms Cross Site Request Forgery via admin endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
CVSS 5.3 · Medium · EPSS 0.1%
- Published
- Updated
Stack: php
Affected products and versions
nodcms
- Versions
- 1.0: Affected
No fix published
khodakhah/nodcms Packagist
- Versions
- 3.2.0
- 3.3.0
- Affected ranges
- ECOSYSTEM: ≤ 3.4.1
No fix published