CVE-2026-28281: high-severity vulnerability in instantsoft icms2
InstantCMS has Multiple CSRF Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.2%
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected products
instantsoft · icms2Related CVEs — instantsoft icms2
In the same product, most dangerous first.
CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2026-54611MEDIUMInstantCMS has Remote Code Execution in package installerEPSS 0.7%CVE-2025-59055MEDIUMInstantCMS vulnerable to Server-Side Request Forgery via package installerEPSS 0.5%CVE-2024-31213LOWInstantCMS Open Redirect vulnerabilityEPSS 0.4%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%