CVE-2018-14583

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...

CVE-2018-14582

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

PT-2018-12593

Name of the Vulnerable Software and Affected Versions XYHCMS version 3.5 Description The issue allows for CSRF to add a background administrator account through the 'xyhai.php?s=/Auth/addUser' API endpoint. Recommendations For XYHCMS version 3.5, consider implementing proper CSRF protection...

PT-2018-12592

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for CSRF to add a background administrator account through the "index.php?r=admini/admin/create" endpoint. Recommendations For BageCMS version 3.1.3, consider implementing CSRF protection...