A cross‑site request forgery flaw is present in the delete.php endpoint of Jason2605 AdminPanel 4.0. The vulnerability allows an attacker to trigger delete operations from a victim’s browser without the victim’s explicit consent. The description does not disclose what data or resources are removed, so the potential impact depends on the functionality of the delete.php endpoint.

The flaw affects Jason2605 AdminPanel, version 4.0. No other versions or vendors are identified as impacted.

The CVSS score of 6.3 reflects a moderate level of severity, and the EPSS score is currently unavailable; the flaw is not listed in CISA's KEV catalog. Attackers can exploit the vulnerable endpoint by sending a crafted HTTP request from a malicious site, and the delete.php endpoint can be invoked via a simple request (this is inferred from typical CSRF behavior). The description does not specify authentication requirements, so it is unclear whether the endpoint requires administrative credentials or can be accessed anonymously. The lack of a KEV listing suggests no known exploitation at the time of this analysis, yet CSRF flaws that impact deletion actions remain a notable risk.