VYPR
← All advisories
High severity7.1NVD Advisory· Published Mar 10, 2026· Updated Jun 17, 2026

CVE-2026-28281

CVE-2026-28281

Description

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

Affected products

3
  • Instantsoft/Instantcms2 versions
    cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*range: <2.18.1
    • (no CPE)range: <2.18.1
  • Instantsoft/Icms2cpe-rescue
    Range: < 2.18.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.