CVE-2018-25186

🗓️ 06 Mar 2026 12:19:12Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

Tina4 Stack 1.0.3 CSRF allows attackers to modify admin credentials via forged POST to the profile endpoint.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2018-25186	6 Mar 202612:19	–	attackerkb
Circl	CVE-2018-25186	6 Mar 202615:53	–	circl
CNNVD	Tina4 Stack 跨站请求伪造漏洞	6 Mar 202600:00	–	cnnvd
Cvelist	CVE-2018-25186 Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile	6 Mar 202612:19	–	cvelist
EUVD	EUVD-2018-21639	6 Mar 202615:31	–	euvd
NVD	CVE-2018-25186	6 Mar 202613:16	–	nvd
Positive Technologies	PT-2026-23696	6 Mar 202600:00	–	ptsecurity
Vulnrichment	CVE-2018-25186 Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile	6 Mar 202612:19	–	vulnrichment

NVD

Vulners

Node

tina4 tina4_stackMatch1.0.3

[
  {
    "vendor": "Tina4",
    "product": "Tina4 Stack",
    "versions": [
      {
        "version": "1.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/45834
vulncheck	www.vulncheck.com/advisories/tina-stack-cross-site-request-forgery-via-profile

Parameter	Position	Path	Description	CWE
password	request body	/kim/profile	CSRF vulnerability allows forging POST to /kim/profile to modify admin credentials via hidden form fields.	CWE-352
email	request body	/kim/profile	CSRF vulnerability allows forging POST to /kim/profile to modify admin credentials via hidden form fields.	CWE-352

17 Jun 2026 01:54Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.3 - 5.3

CVSS 46.9

EPSS0.00136

SSVC

CWE-352