CVE-2018-7733

HIGH

YxtCMF < 3.1 - Cross-Site Request Forgery via User Addition

Title source: llm

Description

An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_post.html.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/SQYY/CVE/blob/master/YxtCMF_C

Scores

CVSS v3 8.8

EPSS 0.0049

EPSS Percentile 38.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

yxtcmf/yxtcmf < 3.1

Published Mar 06, 2018

Tracked Since Feb 18, 2026