Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28281 Cross-Site Request Forgery (CSRF) Vulnerability in InstantCMS Before 2.18.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28281
Post summary
The note marks CVE-2026-28281 as a CSRF vulnerability affecting InstantCMS versions prior to 2.18.1, directing readers to a vulnerability database entry for more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | instantcms | instantcms | - | - | - |