VULNERABILITY INTELLIGENCE
CVE-2018-25387
CVSS score6.9 MEDIUM
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-05-29
Last modified2026-07-21
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Description
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)