CVE-2020-37217: EASY2PILOT

Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days.

Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.

Affected products

• EASY2PILOT EASY2PILOT: version 7 only

Published 2026-05-13. Last modified 2026-06-17.