CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

PT-2026-87079

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

CVE-2026-81888

@hono/oauth-providers , authentication middleware for the Hono web framework, has a flaw in its OAuth state validation. Prior to version 0.8.6 , the built-in social login providers accept an OAuth callback even when the state value is absent on both the expected and received sides, causing the an...

CVE-2026-45126

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-17069 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069

IBM i versions 7.3–7.6 are affected by CVE-2026-17069 due to improper validation of anti-CSRF tokens, enabling a remote authenticated attacker to bypass security restrictions (Impact: C/H; Privileges Required: Low; User Interaction: None). The vulnerability is tied to Digital Certificate Manager ...

Cross-site Request Forgery (CSRF)

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the apiMiddleware request filter in src/apiMiddleware.ts. An attacker can create accounts or change configuration by causing a logged-in administrator’s browser to send a...

Cotonti: Cross-Site Request Forgery in the administration rights handler

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action 'a=update' modifies group access rights including via cotauthaddgroup without calling cotcheckxg to validate th...

CVE-2026-55745

CVE-2026-55745 affects Cotonti 1.0.0 (master, commit f43f1fc3) in the Personal File Storage (PFS) module. The vulnerability arises in modules/pfs/inc/pfs.editfolder.php, where the folder update action (a=update) updates metadata (title, description, public/gallery flags) without calling cot_check...

CVE-2026-55741 Cotonti CSRF in admin.config.php allows unauthorized configuration changes

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action 'a=update' processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate...

CVE-2026-9591

CVE-2026-9591 documents a CSRF vulnerability in the SimplCommerce News module. The issue is in the NewsItemApiController and allows an unauthenticated remote attacker to create or modify news items as an administrator by submitting a crafted form to /api/news-items, due to missing anti-CSRF prote...

CVE-2026-40325

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.restore function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted...

CVE-2018-25334: Cross-Site Request Forgery (CSRF)

Zechat 1.5 contains a Cross-Site Request Forgery CSRF vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections. The application uses a CSRF token, but an attacker can use the hashtag parameter to inject an encoded payload and bypass the CSRF...

EUVD-2026-28161

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in csettings.cfc does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or link that, when visited by a logged-in...

PT-2026-38229

Name of the Vulnerable Software and Affected Versions Masa CMS versions prior to 7.2.10 Masa CMS versions prior to 7.3.15 Masa CMS versions prior to 7.4.10 Masa CMS versions prior to 7.5.3 Description The createBundle function in csettings.cfc fails to properly validate anti-CSRF Cross-Site Reque...

CVE-2026-36960

A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...