CVE-2018-25186 — Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile
Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests to the profile en…
Published: 2026-03-06 · CVSS: 6.9 · CVSS 4.0
Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests to the profile endpoint. Attackers can craft HTML forms targeting the /kim/profile endpoint with hidden fields containing malicious user data like passwords and email addresses to update administrator accounts without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7