CVE-2026-38934
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A Cross-Site Request Forgery vulnerability was found in diskover-community version 2.3.5 and earlier. This flaw allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php file.
Risk Assessment
An attacker can exploit CSRF to perform unauthorized actions in the context of an authenticated administrator, leading to configuration takeover and leakage of confidential organizational data.
Recommendation
Immediately update diskover-community to a version newer than 2.3.5 and implement CSRF protection mechanisms such as anti-CSRF tokens in forms.
Other vulnerabilities in diskover-community
See all- CVE-2026-38936Medium
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter.
- CVE-2026-38935Medium
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community version 2.3.5 and earlier. An attacker can inject malicious JavaScript code via the doctype parameter in public/view.php.
Original NVD description (English source)
Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php