ExpressionEngine · Report #1096115
Arbitrary comment content change with GET CSRF.
Validstatus
lowseverity
27upvotes
28 May 2024disclosed
Summary
A vulnerability in Expression Engine 6.0.1 allows unauthorized modification of comments through improperly protected requests.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.