CVE-2026-111883

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-111883

Locust versions through 2.46.7 are vulnerable to a cross-site request forgery (CSRF) flaw within the Web UI. The issue allows remote attackers to perform unauthorized actions by luring an operator to a malicious page that triggers cross-site GET requests to the /stop and /stats/reset endpoints. S...

EUVD-2026-104320

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-111883 Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

PT-2026-117393

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-9014

The CVE describes a vulnerability in the WordPress WP Promoter plugin (versions

Quick Adsense < 2.8.2 - Subscriber+ Post Stats Reset

The plugin does not have authorisation and CSRF checks in some of its AJAX actions allowing any authenticated users, such as subscribers to call them and reset Posts stats for example fetch"/wp-admin/admin-ajax.php", "headers": "accept": "/", "accept-language": "en-US,en;q=0.9", "content-type":...

Quick Adsense < 2.8.2 - Subscriber+ Post Stats Reset

The plugin does not have authorisation and CSRF checks in some of its AJAX actions allowing any authenticated users, such as subscribers to call them and reset Posts stats for example PoC fetch"/wp-admin/admin-ajax.php", "headers": "accept": "/", "accept-language": "en-US,en;q=0.9", "content-type...

WordPress Quick Adsense plugin <= 2.8.1 - Post Stats Reset vulnerability

Post Stats Reset vulnerability discovered by Jan w Oleju in WordPress Quick Adsense plugin versions = 2.8.1. Solution Update the WordPress Quick Adsense plugin to the latest available version at least 2.8.2...