CVE-2018-15682: Btiteam Xbtit

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.

Affected products

• Btiteam Xbtit: up to and including 2.5.4

Published 2018-09-05. Last modified 2026-06-17.