CVE-2023-4659
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to perform actions as an administrator simply by changing the token value to "admin". It is also possible to send POST, GET and DELETE requests without any token value, allowing an unprivileged remote user to create, delete and modify user accounts.
Risk Assessment
An attacker can gain administrative control over the application and modify user accounts without valid credentials. This poses a serious risk to data integrity and confidentiality.
Recommendation
Implement proper CSRF protection with server-side token validation and update the application to a patched version.
Other vulnerabilities in Aplikacja webowa
See all- CVE-2026-41964High
CVE-2026-41964 describes a permission control vulnerability in a web application. Exploitation of this vulnerability may impact system availability.
- CVE-2026-6356Critical
A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.
- CVE-2025-58585Medium
Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.
Original NVD description (English source)
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS