CVE-2018-1000501: Instant-Update Instant Update CMS

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.

Affected products

• Instant-Update Instant Update CMS: before 0.3.3 (fixed in 0.3.3)

Published 2018-06-26. Last modified 2026-06-17.