CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...