CVE-2014-4718: Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers...

Security readout for executives and security teams

Lunar CMS versions before 3.3-3 have CSRF flaws that could let an attacker abuse a logged-in administrator’s browser. The most serious reported impact is creating a Super user account. The bundle does not show active exploitation, but public exploit references exist, so exposed legacy installations deserve prompt review. Exposure is most likely in legacy Lunar CMS deployments older than 3.3-3, especially where administrators use the CMS while browsing untrusted content. Internet exposure of the admin area increases risk, but exploitation still depends on administrator interaction or session state. Treat this as high priority only if Lunar CMS is present. The business risk is administrative takeover of an outdated CMS. If no Lunar CMS exists, record the result and deprioritize. If found, prioritize upgrade, isolation, and account review. Mitigation focus: Identify any Lunar CMS deployment and confirm its exact version.; Upgrade away from Lunar CMS versions before 3.3-3 where vendor guidance supports it.; Restrict administrative access to trusted networks or VPN paths..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.