CVE-2018-12596

CVE-2018-12596 Ektron CMS 9.20 SP2 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local admins. Exploit-DB publication at...