Security Advisory

CVE-2026-9591

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-17 13:41:49

Last updated 2026-06-18 13:46:21

Assigner Checkmarx

CVSS score 6.9

State PUBLISHED

Description

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.

← Browse all CVEs View on cve.org ↗