CVE-2019-16531

HIGH

LayerBB < 1.1.4 - Cross-Site Request Forgery via Admin General Settings

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-16531. PoCs published by 0xB9.

AI-analyzed exploit summary This is a proof-of-concept for multiple CSRF vulnerabilities in LayerBB 1.1.3, demonstrating how an attacker can manipulate user profiles, forums, and system settings via crafted HTML forms.

Description

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

Exploits (1)

exploitdb WORKING POC
by 0xB9 · htmlwebappsphp
https://www.exploit-db.com/exploits/47403

This is a proof-of-concept for multiple CSRF vulnerabilities in LayerBB 1.1.3, demonstrating how an attacker can manipulate user profiles, forums, and system settings via crafted HTML forms.

Classification
Working Poc 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: LayerBB 1.1.3
No auth needed
Prerequisites: Victim must be authenticated and tricked into submitting the forms
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/AndyRixon/LayerBB/pull/40
Exploit, Third Party Advisory x_refsource_misc
https://github.com/0xB9/LayerBB-1.1.3-CSRF/blob/master/README.md
Patch, Third Party Advisory x_refsource_misc
https://github.com/AndyRixon/LayerBB/compare/1.1.3...1.1.4

Scores

CVSS v3 8.8
EPSS 0.0021
EPSS Percentile 43.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
layerbb/layerbb < 1.1.4
Published Sep 20, 2019
Tracked Since Feb 18, 2026