Description
Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.
CVSS 5.3EPSS 0.16199999999999998%Risque 0.54
Voir la source- Publication
- 2026-04-04 14:16:17
- Versions concernées
- ==1.7
- Type
- Core software
- Dernière modification
- 2026-07-21 07:10:00
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N