CVE-2020-19268

MEDIUM

Dswjcms 1.6.4 - Authenticated Cross-Site Request Forgery in User/tfAdd

Title source: llm

Description

A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/tifaweb/Dswjcms/issues/6

Scores

CVSS v3 5.7

EPSS 0.0031

EPSS Percentile 22.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Details

CWE

CWE-352

Status published

Products (1)

dswjcms_project/dswjcms 1.6.4

Published Sep 09, 2021

Tracked Since Feb 18, 2026