CVE Vulnerability

CWE-352

CVE-2018-16365

by

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.

CVE-2018-16366

by

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.

CVE-2018-16314

by

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.

CVE-2018-16315

by

In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.

CVE-2018-16331

by

admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account’s password.

CVE-2018-16332

by

An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.