CVE-2018-12603

CVE-2018-12603 affects LFCMS 3.7.0: a Cross-Site Request Forgery in admin.php via the s parameter allows remote attackers to hijack user authentication and add an administrator account. The issue enables adding admin accounts without user consent, as described in CVE-2018-12114 related disclosure...

CVE-2018-12602

CVE-2018-12602 concerns LFCMS 3.7.0, where a Cross-Site Request Forgery flaw allows arbitrary user addition. The CNVD entry (CNVD-2018-14218) confirms a CSRF vulnerability in LFCMS 3.7.0 and describes the impact as enabling remote attackers to add users. Related sources (NVD/NIST, CVE records) de...