CVE-2018-16448

8.8 highEPSS 0.5%

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2018-09-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

chshcms:cscms

References

https://github.com/chshcms/cscms/issues/1
https://github.com/chshcms/cscms/issues/1

Check your stack JSON