2 matches found
CVE-2026-88418
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...
6.2AI score0.00254EPSS
SaveExploits0References1
CVE-2026-88418
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...
0.00254EPSS
SaveExploits0References1
20