CVE-2018-25190 Easyndexer 1.0 Cross-Site Request Forgery via createuser.php
Unauthenticated attackers can create administrative accounts via CSRF, leading to privilege escalation and account takeover in Easyndexer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25190?
CVE-2018-25190 is a medium-severity vulnerability in Sourceforge Easyndexer, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.
Weakness: CWE-352
Which versions are affected by CVE-2018-25190?
It affects 1 product.
Products include Rul10 Easyndexer.
How do I fix CVE-2018-25190?
No fix has been published for CVE-2018-25190 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-25190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25190 exists.
Other vulnerabilities in Sourceforge Easyndexer
Sources
Also known as GHSA-7mj6-rh2f-w525.