---
id: CVE-2016-20054
title: >-
  Nodcms contains a cross-site request forgery vulnerability that allows
  attackers to perform unauthorized administrative actions by crafting malicious
  forms
summary: >-
  Nodcms contains a cross-site request forgery vulnerability that allows
  attackers to perform unauthorized administrative actions by crafting malicious
  forms. Attackers can trick authenticated administrators into submitting
  requests to adm…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
  - CWE-352
vendor: nodcms
product: nodcms
affected:
  - nodcms = 1.0
published: '2026-04-04'
updated: '2026-07-20'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-20054'
references:
  - url: 'https://www.exploit-db.com/exploits/40707'
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00106
epssPercentile: 0.01261
ingestedAt: '2026-07-21T16:51:41.682Z'
---

## Overview

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

## Affected

- `nodcms = 1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.