CVE-2016-20051: Snewscms Snews

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.

Affected products

• Snewscms Snews: up to and including 1.7

Published 2026-04-04. Last modified 2026-07-21.