PT-2018-18244

Name of the Vulnerable Software and Affected Versions: YxtCMF version 3.1 Description: An issue was discovered in YxtCMF, where the RbacController.class.php file is vulnerable to CSRF attacks. This allows an attacker to modify an administrator account via the "index.php/admin/user/add post.html"...

CVE-2018-7733: Cross-Site Request Forgery (CSRF)

An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...