CVE-2019-9688

sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...