{"id":"GHSA-3qcm-pj6q-w4c5","aliases":["CVE-2016-20054"],"title":"Nodcms contains a cross-site request forgery vulnerability","description":"Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.","severity":"medium","score":4.3,"published":"2026-04-04T21:30:27.000Z","modified":"2026-04-16T01:56:32.834Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"khodakhah/nodcms","ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.4.1"}],"type":"ECOSYSTEM"}],"versions":["3.2.0","3.3.0"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2016-20054","https://github.com/khodakhah/nodcms","https://www.exploit-db.com/exploits/40707"],"sources":[{"name":"OSV","id":"GHSA-3qcm-pj6q-w4c5","modified":"2026-04-16T01:56:32.834737Z","url":"https://osv.dev/vulnerability/GHSA-3qcm-pj6q-w4c5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","score":5.3}]}