CVE-2020-37217
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
May 13, 2026
Vendor
unknown
Description
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.