CVE-2007-5109
Flatnuke - CSRF
Title source: ruleDescription
Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified (1) regpass and (2) level parameters in a none_Login action, as demonstrated by using a Flash object to automatically make the request.
References (5)
Scores
EPSS
0.0018
EPSS Percentile
39.2%
Classification
CWE
CWE-352
Status
draft
Affected Products (1)
flatnuke/flatnuke
Timeline
Published
Sep 26, 2007
Tracked Since
Feb 18, 2026