Threats Tagged 'cve-2026-88418'
View all threats tagged with 'cve-2026-88418'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-88418'
Click on any threat for detailed analysis and mitigation recommendations
0 CMSimple version 5.24 has CSRF protection disabled by default, causing the csrfProtection() function to be ineffective on state-changing admin requests. Administrator authentication relies solely on cookies without CSRF token enforcement, allowing an attacker to trick a logged-in admin into submitting a forged content-save request. This request can include a scripting marker that is stored directly in content/content.php. On subsequent page views, the scripting marker is executed via PHP eval(), resulting in persistent remote code execution on the web server accessible to all visitors, including unauthenticated ones. Join the discussion | CVE Database V5 | 09/22/2026, 00:00:00 UTC Added: 09/22/2026, 19:49:04 UTC |
Showing 1 to 1 of 1 result