CVE-2020-37091

Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)

CVSS 5.1 MEDIUMEPSS 0.1%CWE-352

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 feb 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administrative accounts without authentication. Attackers can craft malicious HTML forms to add admin users and upload PHP files with unrestricted file upload capabilities through the FAQ attachment system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Maian Media · Maian Support Helpdesk

Referencias

https://www.exploit-db.com/exploits/48386 https://www.maiansupport.com https://www.vulncheck.com/advisories/maian-support-helpdesk-cross-site-request-forgery-add-admin