CVE-2018-25190CWE-352

Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Medium · published March 6, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00132 · 2.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-06T12:19Z
EPSS history
Timeline
  • 06 MAR 12:19Z
    Easyndexer 1.0 Cross-Site Request Forgery via createuser.php
    cvelistv5