PT-2026-24135 · Unknown · Instantcms

0Xhamy · Publicado 2026-03-09 · Atualizado 2026-03-13 · CVE-2026-28281

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions InstantCMS versions prior to 2.18.1

Description InstantCMS does not properly validate Cross-Site Request Forgery (CSRF) tokens. This allows attackers to perform actions on behalf of a user without their knowledge. Specifically, an attacker could grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests.

Recommendations Update to InstantCMS version 2.18.1 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-28281

GHSA-PP43-262Q-H73M

Produtos afetados

Instantcms

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28281.json · Exploit
• https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m · Aviso do Fabricante
• https://t.me/CVEtracker/46940 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28281 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28281 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2031471657420828703 · Publicação no Twitter
• https://t.me/cveNotify/155420 · Publicação no Telegram