FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
thedaylightstudio fuel cms 1.4.3