CVE-2026-28281

7.1 highEPSS 0.1%

High (7.1) in instantcms instantcms. EPSS 0.1% chance of exploitation in the next 30 days.

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2026-03-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

instantcms:instantcms

References

https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m

Check your stack JSON