CVE Feed

    Dashboard / CVE / CVE-2020-24271

    CVE-2020-24271

    A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.

    Published:Feb 1, 2021
    Last Modified:Nov 21, 2024
    EPS:Feb 1, 2021
    EPSS Score:0.00145
    CVSS Score:8.8

    Affected Products

    Vendor
    Easycms
    Product
    Easycms

    Exploits

    https://github.com/users/yohoho221/projects/1https://github.com/users/yohoho221/projects/1

    Related CVEs

    CVE-2026-3786 (CVSS 2.1) — A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the f…
    CVE-2026-3785 (CVSS 2.1) — A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /…
    CVE-2026-1105 (CVSS 5.5) — A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /User…
    CVE-2022-23358 (CVSS 9.8) — EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided b…
    CVE-2019-6294 (CVSS 8.8) — An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/list…
    CVE-2018-17113 (CVSS 6.1) — App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the upload…
    CVE-2018-16773 (CVSS 4.8) — EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent …
    CVE-2018-16759 (CVSS 6.1) — The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) …
    CVE-2018-16345 (CVSS 8.8) — An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via i…
    CVE-2018-12971 (CVSS 6.5) — EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High