CVE-2026-88959: Missing Authorization

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2022-41539

Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/usersadd.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2018-15845

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

CVE-2018-15845: Cross-Site Request Forgery (CSRF)

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

PT-2018-13234

Name of the Vulnerable Software and Affected Versions Gleez CMS version 1.2.0 Description The issue allows for a CSRF attack that can add an administrator account. This is achieved via the "admin/users/add" API endpoint, utilizing the admin/users/add path. Recommendations For Gleez CMS version...

CVE-2014-5100

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

PT-2014-6277

Name of the Vulnerable Software and Affected Versions Omeka versions prior to 2.2.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding a new super user account via a request to "admin/users/add", inserting cross-site scripti...

PT-2014-2628

Name of the Vulnerable Software and Affected Versions Umisoft UMI.CMS versions prior to 2.9 build 21905 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to...

CVE-2013-2754: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to admin/users/add/user/do/...

PT-2012-3312

Name of the Vulnerable Software and Affected Versions Webfolio CMS versions 1.1.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be done through "admin/users/add" or "admin/pages/edit/web page name" API endpoints...

CVE-2012-1498: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator via an add action to admin/users/add or 2 modify a web page via a save action to...