CVE-2015-2680: Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers...

Security readout for executives and security teams

CVE-2015-2680 is a CSRF flaw in MetalGenix GeniXCMS before 0.0.2. If an administrator is already logged in and is tricked into making a malicious web request, an attacker could cause the application to add another administrator account. Exposure appears limited to legacy GeniXCMS deployments earlier than 0.0.2. Risk is highest where the administrative interface is reachable by administrators browsing the web and where no compensating CSRF defenses or access controls exist. Prioritize remediation if GeniXCMS is internet-facing or still used for business-critical content. The product appears old and niche, but administrator account creation is a serious control failure when the vulnerable version is present. Mitigation focus: Upgrade GeniXCMS to 0.0.2 or later where applicable.; Review the linked vendor release and repository commit for the security fix.; Restrict administrative interface access to trusted networks or VPN users..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.