CVE-2020-37091

Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)

CVSS 5.1 MEDIUMEPSS 0.1%CWE-352

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

03 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administrative accounts without authentication. Attackers can craft malicious HTML forms to add admin users and upload PHP files with unrestricted file upload capabilities through the FAQ attachment system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Maian Media · Maian Support Helpdesk

References

https://www.exploit-db.com/exploits/48386 https://www.maiansupport.com https://www.vulncheck.com/advisories/maian-support-helpdesk-cross-site-request-forgery-add-admin