CVE-2020-37046 MEDIUM

CVE-2020-37046: Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery

Vendor Adikiss
Product Sistem Informasi Pengumuman Kelulusan Online
Weakness CWE-352 · CSRF
Published January 30, 2026
Last update February 2, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users through the tambahuser.php endpoint. Attackers can craft a malicious HTML form to submit admin credentials and create new administrative accounts without the victim's consent.

Key dates

02Disclosure timeline

January 30, 2026 CVE published
February 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43116 WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-0642 Cross-Site Request Forgery (CSRF) in squidex/squidex CVE-2023-32514 WordPress Google Site Verification plugin using Meta Tag Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-27633 WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-35091 WordPress WooCommerce Stock Manager Plugin <= 2.10.0 is vulnerable to Cross Site Request Forgery (CSRF)