CVE-2013-2754: Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote att...

Security readout for executives and security teams

This vulnerability lets an attacker abuse a logged-in UMI.CMS administrator’s browser to create another administrator account. The attacker still needs an authenticated administrator to trigger the request, but successful exploitation could give persistent administrative access to the CMS. Organizations are exposed if they still run Umisoft UMI.CMS versions before 2.9 build 21905, especially with administrator panels reachable by users who browse externally while authenticated. Treat this as urgent for legacy UMI.CMS deployments because the business impact is administrative CMS compromise. Priority is lower if UMI.CMS is not present or all instances are fixed builds. Mitigation focus: Upgrade UMI.CMS to 2.9 build 21905 or later where applicable.; Check vendor advisory guidance before applying production changes.; Limit administrator interface access to trusted networks or VPN..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.