CVE-2016-4884

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
baserCMS Users CommunitybaserCMS plugin Blogversion 3.0.10 and earlier

References

Timeline

Published
May 12, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-48858.8Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the autCVE-2016-48868.8Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the autCVE-2016-48878.8Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack theCVE-2016-48885.4Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web scCVE-2016-48898.8ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to reCVE-2016-48905.3ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain CVE-2016-48918.8Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an adminiCVE-2016-48926.1Cross-site scripting vulnerability in SetsucoCMS all versions allows remote attackers to inject arbitrary web script or HTML via unspecifiedCVE-2016-48938.8SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary SQL commands via unspeCVE-2016-48945.3SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-48958.8SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.CVE-2016-48966.5SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via u
CVE-2016-4884: High severity, CVSS 8.8 | Vulnix