CVE-2020-37007 Liman 0.7 - Cross-Site Request Forgery (Change Password)
Attackers can trick logged-in users into changing their passwords or account settings via CSRF, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-37007?
CVE-2020-37007 is a medium-severity vulnerability in salihciftci Liman, published on 29 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.
Weakness: CWE-352
Which versions are affected by CVE-2020-37007?
It affects 1 product.
Products include Salihciftci Liman.
How do I fix CVE-2020-37007?
No fix has been published for CVE-2020-37007 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-37007 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37007 exists.
Sources
Also known as GHSA-wx76-4vvv-7j37.