CVE-2018-10267

WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.

• CWE-352

• https://github.com/taosir/wtcms/issues/1Third Party Advisory
• https://www.hackpwn.me/2018/04/21/1/Exploit, Third Party Advisory, URL Repurposed
• https://github.com/taosir/wtcms/issues/1Third Party Advisory
• https://www.hackpwn.me/2018/04/21/1/Exploit, Third Party Advisory, URL Repurposed

Published

Apr 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10258A CSV Injection vulnerability was discovered in Shopy Point …
• CVE-2018-10259An Authenticated Stored XSS vulnerability was found in HRSAL…
• CVE-2018-1026A remote code execution vulnerability exists in Microsoft Of…
• CVE-2018-10260A Local File Inclusion vulnerability was found in HRSALE The…
• CVE-2018-10265An issue was discovered in HongCMS v3.0.0. There is a CSRF v…
• CVE-2018-10266BEESCMS 4.0 has a CSRF vulnerability to add an administrator…
• CVE-2018-10268An issue was discovered in FastAdmin V1.0.0.20180417_beta. T…
• CVE-2018-1027A remote code execution vulnerability exists in Microsoft Ex…7.8
• CVE-2018-1028A remote code execution vulnerability exists when the Office…
• CVE-2018-10283CliqueMania loja virtual 14 has SQL Injection via the patch/…
• CVE-2018-10284Adaltech G-Ticket v70 EME104 has SQL Injection via the mobil…
• CVE-2018-10285The Ericsson-LG iPECS NMS A.1Ac web application uses incorre…