Nodcms contains a cross-site request forgery vulnerability
Date: 2026-04
Affected: composer/khodakhah/nodcms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2016-20054
CWE: CWE-352
CWE-79
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.


Mitigations:

Architectural layers (MAESTRO):