CVE-2018-12971

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jun 29, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-129729.8An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2ranCVE-2018-129736.1An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.CVE-2018-129757.5The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readableCVE-2018-129769.8In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cCVE-2018-129778.8A SQL injection vulnerability in the SoftExpert (SE) Excellence Suite 2.0 allows remote authenticated users to perform SQL heuristics by pulCVE-2018-129796.5An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticaCVE-2018-12985.9A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocCVE-2018-129808.8An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authentiCVE-2018-129815.4An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited bCVE-2018-129825.5Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have deCVE-2018-129837.8A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveCVE-2018-129849.8Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
CVE-2018-12971: Medium severity, CVSS 6.5 | Vulnix