Medium severity · published Mar 6, 2026
CVE-2018-25190
Easyndexer 1.0 Cross-Site Request Forgery via createuser.php
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Easyndexer · Sourceforge
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25190
Exploit
https://www.exploit-db.com/exploits/45815
Broken Link
https://www.vulncheck.com/advisories/easyndexer-cross-site-request-forgery-via-createuserphp
More from Easyndexer
7.5
CVE-2018-25178
Easyndexer 1.0 Arbitrary File Download via showtif.php