Vulnerability · Published Jan 29, 2026 · Assigned by VulnCheck
CVE-2020-37007Liman 0.7 - Cross-Site Request Forgery (Change Password)
Medium 5.3
In plain English
A medium-severity cross-site request forgery in Liman from salihciftci. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| salihciftci | Liman | 0.7 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- ExploitDB-48869 exploit
- Archived Liman GitHub Repository product
- VulnCheck Advisory: Liman 0.7 - Cross-Site Request Forgery (Change Password) third-party-advisory