CVE-2010-2039: Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attac...

Security readout for executives and security teams

This flaw affects older gpEasy CMS versions and could let an attacker trick a logged-in administrator into creating a new admin account. That could give the attacker control of the website. The source bundle does not provide CVSS scoring, vendor fix details, or evidence of active exploitation. Exposure is likely limited to organizations still running gpEasy CMS 1.6.2, 1.6.1, or earlier. Risk is highest where administrators are active and the admin interface remains reachable. The structured affected-product data is incomplete. Treat this as urgent if legacy gpEasy remains in use, because the described outcome is unauthorized administrator creation. If gpEasy is not present, record the inventory evidence and deprioritize. Mitigation focus: Check vendor or project guidance for fixed gpEasy versions or migration advice.; Upgrade from gpEasy CMS 1.6.2, 1.6.1, and earlier where possible.; Restrict administrative access to trusted networks or VPN users..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.