Description
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
Published: 2026-04-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.exploit-db.com/exploits/40707 cve-icon cve-icon
History

Sat, 04 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Description Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
Title Nodcms Cross Site Request Forgery via admin endpoints
First Time appeared Nodcms
Nodcms nodcms
Weaknesses CWE-79
CPEs cpe:2.3:a:nodcms:nodcms:1.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:2.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.4.1:*:*:*:*:*:*:*
Vendors & Products Nodcms
Nodcms nodcms
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Nodcms Nodcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-04T19:59:44.200Z

Reserved: 2026-04-04T13:34:39.170Z

Link: CVE-2016-20054

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-04T20:16:15.940

Modified: 2026-04-04T20:16:15.940

Link: CVE-2016-20054

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses