CVE-2016-20051 Snews CMS 1.7 Cross-Site Request Forgery via changeup
Attackers can trick administrators into changing their credentials via CSRF, leading to unauthorized account takeover in Snews CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20051?
CVE-2016-20051 is a medium-severity vulnerability in Snewscms Snews CMS Cross Site Request Forgery, published on 4 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.
Weakness: CWE-352
Which versions are affected by CVE-2016-20051?
It affects 1 product.
Products include Snewscms Snews.
How do I fix CVE-2016-20051?
No fix has been published for CVE-2016-20051 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-20051 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20051 exists.
Other vulnerabilities in Snewscms Snews CMS Cross Site Request Forgery
Sources
Also known as GHSA-qqrh-w78r-g98g.