Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
InstantCMS has Multiple CSRF Vulnerabilities
Source: NVD (National Vulnerability Database)
Vulnerability Description
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
InstantCMS 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
InstantCMS是instantSoft开源的一个免费的开源 CMS。 InstantCMS 2.18.1之前版本存在跨站请求伪造漏洞，该漏洞源于未验证CSRF令牌，可能导致攻击者授予用户版主权限、执行计划任务、将帖子移至垃圾箱以及代表用户接受好友请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
instantsofticms2 < 2.18.1 -
II. Public POCs for CVE-2026-28281
#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
kimi-k2.5 · 10583 chars
Paid plan includes:
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-28281
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: icms2
Same vendor: instantsoft
Same weakness: CWE-352
V. Comments for CVE-2026-28281

No comments yet

Leave a comment