CVE-2023-37131

MediumCVSS 6.5

Published: 06/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

YznCMS v1.1.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the /public/admin/profile/update.html component, allowing attackers to arbitrarily change the Administrator password via a crafted POST request.

Risk Assessment

This vulnerability could lead to the compromise of the administrator account, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to implement CSRF protection mechanisms and update YznCMS to the latest version to mitigate this vulnerability.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.