CVE-2020-20586

MEDIUM Year: 2020
CVSS v3 Score
4.5
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-352
View all →

Vulnerability Description

A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.

Related Vulnerabilities

CVE-2017-8382

MEDIUM
CVSS:4.5(Medium)

admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.

CWE-3522017

CVE-2020-36191

MEDIUM
CVSS:4.5(Medium)

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

CWE-3522020

CVE-2021-22701

MEDIUM
CVSS:4.5(Medium)

A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that co...

CWE-3522021

CVE-2022-0238

MEDIUM
CVSS:4.5(Medium)

phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)

CWE-3522022

CVE-2022-25576

MEDIUM
CVSS:4.5(Medium)

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.

CWE-3522022

CVE-2022-46062

MEDIUM
CVSS:4.5(Medium)

Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

CWE-3522022