CVE-2016-10738

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-107395.3In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 adCVE-2016-10749.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC ContinCVE-2016-107404.9Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of confiCVE-2016-107414.7In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race cCVE-2016-107426.1Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect viCVE-2016-107437.5hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.CVE-2016-107446.1In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data lCVE-2016-107458.6In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.CVE-2016-107467.5libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connecCVE-2016-107499.8parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and enCVE-2016-10759.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and AcroCVE-2016-107508.1In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can rea
CVE-2016-10738: High severity, CVSS 8.8 | Vulnix