CVE-2010-5319

Kandidat CMS 1.4.2 - Cross-Site Request Forgery via Settings, Pages, or Articles

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a validate action to admin/settings.php, (2) modify pages via the what parameter to admin/edit.php, or (3) modify articles via the edit parameter to admin/news.php.

References (1)

Core 1
Core References

Scores

EPSS 0.0061
EPSS Percentile 45.0%

Details

CWE
CWE-352
Status published
Products (1)
kan-studio/kandidat_cms 1.4.2
Published Jan 03, 2015
Tracked Since Feb 18, 2026