CVE-2018-25174: Abc-ERP Abc ERP

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credentials by submitting forged requests to _configurar_perfil.php. Attackers can craft malicious forms or links containing parameters like usuario, contrasena1, contrasena2, nombre, and email to change admin account settings without authentication.

Affected products

• Abc-ERP Abc ERP: version 0.6.4 only

Published 2026-03-06. Last modified 2026-06-17.