{"id":"CVE-2015-1585","aliases":[],"url":"https://o3.security/vulnerability/CVE-2015-1585","summary":"Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML…","details":"Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.","published":"2015-02-19T15:59:14.673","modified":"2026-06-17T00:22:39.000","cvss":null,"epss":{"score":0.01094,"percentile":0.62223,"asOf":"2026-07-31"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[],"fix":null,"references":[{"type":"EXPLOIT","url":"http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html"},{"type":"WEB","url":"http://www.securityfocus.com/archive/1/534709/100/0/threaded"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100925"},{"type":"WEB","url":"https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29"},{"type":"EXPLOIT","url":"http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html"},{"type":"WEB","url":"http://www.securityfocus.com/archive/1/534709/100/0/threaded"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100925"},{"type":"WEB","url":"https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-06-17T00:22:39.000"}}