EIP-2026-100611

This exploit demonstrates a CSRF vulnerability in VWD-CMS version 2.1, allowing an attacker to remove admin roles by tricking an authenticated admin into visiting a malicious page. The PoC uses AJAX to send a GET request to the vulnerable endpoint.