PT-2026-30490 · Victoralagwu · Cmssite

Mr Winst0N · CVE-2019-25682 · Published 2026-04-05 · Updated 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CMSsite version 1.0

Description Cross-site request forgery allows attackers to perform unauthorized administrative actions by crafting malicious HTML forms. Authenticated administrators can be tricked into visiting pages that submit POST requests to the 'users.php' endpoint using parameters such as source=add user, source=edit user, or del=1 to create, modify, or delete administrator accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-25682

Affected Products

Cmssite

References · 4

• 🔥 https://exploit-db.com/exploits/46480 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25682 · Security Note
• https://github.com/VictorAlagwu/CMSsite · Note
• https://vulncheck.com/advisories/cmssite-cross-site-request-forgery-via-users-php · Note