CVE-2017-6086

Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.

• CWE-352

• http://www.openwall.com/lists/oss-security/2017/05/03/7Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/41967/
• http://www.openwall.com/lists/oss-security/2017/05/03/7Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/41967/

Published

Jun 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6076In versions of wolfSSL before 3.10.2 the function fp_mul_com…
• CVE-2017-6077ping.cgi on NETGEAR DGN2200 devices with firmware through 10…9.8
• CVE-2017-6078FastStone MaxView 3.0 and 3.1 allows user-assisted attackers…
• CVE-2017-6079The HTTP web-management application on Edgewater Networks Ed…9.8
• CVE-2017-6080An issue was discovered in Zammad before 1.0.4, 1.1.x before…
• CVE-2017-6081A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x be…
• CVE-2017-6087EyesOfNetwork ("EON") 5.0 and earlier allows remote authenti…
• CVE-2017-6088Multiple SQL injection vulnerabilities in EyesOfNetwork (aka…
• CVE-2017-6089SQL injection vulnerability in PhpCollab 2.5.1 and earlier a…
• CVE-2017-6090Unrestricted file upload vulnerability in clients/editclient…
• CVE-2017-6094CPEs used by subscribers on the access network receive their…
• CVE-2017-6095A SQL injection issue was discovered in the Mail Masta (aka …