Qcms CVE-2018-14978

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2018-08-06 cve@mitre.org

8.8

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Aug 06, 2018 - 15:29 nvd

HIGH 8.8

DescriptionNVD

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.

AnalysisAI

An issue was discovered in QCMS 3.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI. Affected products include: Q-Cms Qcms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Qcms

View all

CVE-2020-10578 HIGH This Week POC

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1. Rated high severit

CVE-2018-14977 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no

CVE-2018-8070 MEDIUM This Month POC

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI. Rated medium severity (CVSS 5.4), this vu

CVE-2018-8069 MEDIUM This Month POC

QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI. Rated medium severity (CVSS 5.4), th

CVE-2018-14976 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14975 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14974 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14973 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14972 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14971 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14970 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

CVE-2018-14969 MEDIUM This Month POC

An issue was discovered in QCMS 3.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2020-36836 HIGH POC

CVE-2015-2295 MEDIUM POC

CVE-2016-6897 MEDIUM POC

CVE-2022-41622 HIGH POC

CVE-2025-2907 CRITICAL POC

Same technique CSRF

View all

CVE-2016-6277 HIGH POC

CVE-2014-100005 HIGH POC

CVE-2017-9757 HIGH POC

CVE-2013-5696 MEDIUM POC

CVE-2013-4152 MEDIUM POC

CVE-2024-7094 CRITICAL

CVE-2015-4624 HIGH POC

CVE-2020-36836 HIGH POC

Share

CVE-2018-14978 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy