PT-2026-24135 · Unknown · Instantcms

0Xhamy · Published 2026-03-09 · Updated 2026-03-13 · CVE-2026-28281

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions InstantCMS versions prior to 2.18.1

Description InstantCMS does not properly validate Cross-Site Request Forgery (CSRF) tokens. This allows attackers to perform actions on behalf of a user without their knowledge. Specifically, an attacker could grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests.

Recommendations Update to InstantCMS version 2.18.1 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-28281

GHSA-PP43-262Q-H73M

Affected Products

Instantcms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28281.json · Exploit
• https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28281 · Security Note
• https://t.me/CVEtracker/46940 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2031471657420828703 · Twitter Post
• https://t.me/cveNotify/155420 · Telegram Post