CVE-2018-25343CWE-352

Smartshop 1 Cross-Site Request Forgery via editprofile.php

Medium · published May 23, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

Smartshop 1 contains a cross-site request forgery vulnerability that allows attackers to modify user profiles by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting editprofile.php with hidden fields for email and password parameters that execute automatically when visited by an authenticated admin user.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00132 · 2.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-05-23T18:30Z
EPSS history
Timeline
  • 23 MAY 18:30Z
    Smartshop 1 Cross-Site Request Forgery via editprofile.php
    cvelistv5