CVE-2026-28281highCWE-352

CVE-2026-28281: fallo de gravedad alta en instantsoft icms2

InstantCMS has Multiple CSRF Vulnerabilities

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear icms2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.2%
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Productos afectados
instantsoft · icms2
CVEs relacionadas — instantsoft icms2

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2026-54611MEDIUMInstantCMS has Remote Code Execution in package installerEPSS 0.7%CVE-2025-59055MEDIUMInstantCMS vulnerable to Server-Side Request Forgery via package installerEPSS 0.5%CVE-2024-31213LOWInstantCMS Open Redirect vulnerabilityEPSS 0.4%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%