CVE-2018-8811

Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users to upload different kind of content artifacts (SVG, .doc, .docx). The uploaded content is stored in the CMS content repository "as is". In case of scripts inside an SVG, this may or may not be "malicious", there is no way of knowing if the uploaded SVG contains the script for a reason. To exploit the "issue", a user must have an account in the CMS as a content manager

• CWE-352

• https://github.com/alkacon/opencms-core/issues/586Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44391/Exploit, Third Party Advisory, VDB Entry
• https://github.com/alkacon/opencms-core/issues/586Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44391/Exploit, Third Party Advisory, VDB Entry

Published

Mar 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8805Yxcms building system (compatible cell phone) v1.4.7 has XSS…
• CVE-2018-8806In libming 0.4.8, there is a use-after-free in the decompile…
• CVE-2018-8807In libming 0.4.8, these is a use-after-free in the function …
• CVE-2018-8808In radare2 2.4.0, there is a heap-based buffer over-read in …
• CVE-2018-8809In radare2 2.4.0, there is a heap-based buffer over-read in …
• CVE-2018-8810In radare2 2.4.0, there is a heap-based buffer over-read in …
• CVE-2018-8812Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-8813Open redirect vulnerability in the login[redirect] parameter…
• CVE-2018-8814Cross-site request forgery (CSRF) vulnerability in WolfCMS 0…
• CVE-2018-8815Cross-site scripting (XSS) vulnerability in the gallery func…
• CVE-2018-8817Wampserver before 3.1.3 has CSRF in add_vhost.php.
• CVE-2018-8819An XXE issue was discovered in Automated Logic Corporation (…