CVE-2026-30498 Details
Description
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the delete.php endpoint of Jason2605 AdminPanel version 4.0 and prior. This vulnerability allows an attacker to perform file deletion actions on behalf of an authenticated user without their consent. The issue arises from a lack of CSRF protections, as the endpoint does not validate the origin of requests or require a CSRF token, and it exposes sensitive actions through GET requests.
Users can update to the fixed version of AdminPanel, which includes CSRF token validation, restricts the delete action to POST requests, and adds Origin/Referer and session validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Mehdi-Ben-Hamou/CVE-2026-30498 | CISA-ADP | ExploitTechnical Description |
| https://github.com/Mehdi-Ben-Hamou/CVE-2026-30498 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Jason2605 AdminPanel | 4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |