CVE-2018-10267

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 22, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-102685.4An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api\controller\User.php avatar parameter.CVE-2018-10277.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-10288.8A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "MiCVE-2018-102839.8CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action.CVE-2018-102849.8Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp eve_cod parameter.CVE-2018-102859.8The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID,CVE-2018-102868.8The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL databasCVE-2018-102895.5In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this CVE-2018-10297.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-102946.1Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.CVE-2018-102958.8ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.CVE-2018-102966.1MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.
CVE-2018-10267: High severity, CVSS 8.8 | Vulnix