Giuseppe Dinverno

**Name of the Vulnerable Software and Affected Versions** GAzie versions 5.20 and earlier **Description** A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, such as changing the password. **Recommendations** For GAzie versions 5.20 and earlier, update to a version later than 5.20 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** gpEasy CMS versions 1.6.2 and earlier **Description** A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin Users action to "index.php". **Recommendations** For gpEasy CMS versions 1.6.2 and earlier, as a temporary workaround, consider restricting access to the Admin Users action in "index.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.