CVE-2021-47702CWE-352

OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php

Medium · published December 9, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint. Attackers can submit malicious requests to trigger unintended actions, such as sending emails or modifying system settings.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00193 · 8.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-09T20:35Z
EPSS history
Timeline
  • 09 DEC 20:35Z
    OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php
    cvelistv5