CVE-2020-37091

Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)

CVSS 5.1 MEDIUMEPSS 0.1%CWE-352

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administrative accounts without authentication. Attackers can craft malicious HTML forms to add admin users and upload PHP files with unrestricted file upload capabilities through the FAQ attachment system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Maian Media · Maian Support Helpdesk

Referências

https://www.exploit-db.com/exploits/48386 https://www.maiansupport.com https://www.vulncheck.com/advisories/maian-support-helpdesk-cross-site-request-forgery-add-admin