Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Nodcms
  • Nodcms

No data.

No data.

References
Link Providers
https://www.spirityenterprise.com/mdr-for-endpoint spirity
https://www.exploit-db.com/exploits/40707 cve-icon cve-icon
History

Sat, 04 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Description Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
Title Nodcms Cross Site Request Forgery via admin endpoints
First Time appeared Nodcms
Nodcms nodcms
Weaknesses CWE-79
CPEs cpe:2.3:a:nodcms:nodcms:1.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:2.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:nodcms:nodcms:3.4.1:*:*:*:*:*:*:*
Vendors & Products Nodcms
Nodcms nodcms
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-04T19:59:44.200Z

Reserved: 2026-04-04T13:34:39.170Z

Link: CVE-2016-20054

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-04T20:16:15.940

Modified: 2026-04-04T20:16:15.940

Link: CVE-2016-20054

cve-icon Redhat

No data.