CVE-2024-31213

InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.

• CWE-601
• CWE-601

• https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfqExploit, Vendor Advisory
• https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfqExploit, Vendor Advisory

Published

Apr 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31208Synapse is an open-source Matrix homeserver. A remote Matrix…6.5
• CVE-2024-31209oidcc is the OpenID Connect client library for Erlang. Denia…5.3
• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8
• CVE-2024-31211WordPress is an open publishing platform for the Web. Unseri…9.8
• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31214Traccar is an open source GPS tracking system. Traccar versi…9.6
• CVE-2024-31215Mobile Security Framework (MobSF) is a security research pla…4.3
• CVE-2024-31216The source-controller is a Kubernetes operator, specialised …5.1
• CVE-2024-31217Strapi is an open-source content management system. Prior to…6.5
• CVE-2024-31218Webhood is a self-hosted URL scanner used analyzing phishing…9.8
• CVE-2024-31219Discourse-reactions is a plugin that allows user to add thei…4.3