CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla 大量RCE エクスプロイト 事前認証なし form.uploadAttachmentFile → CSRFなし → PHPアップロード 概要 CVE-2026-56291 は、Balbooa Forms combaforms Joomla 拡張機能 CISA KEV: 2026年7月10日追加 — 積極的な悪用が確認されました。 脆弱性メカニズム 根本原因 // FormModel::uploadAttachmentFile frontend/models/forms/FormModel.php L122 //...

Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240

Bludit ブルートフォース軽減バイパススクリプト 概要 このスクリプトは、Bludit CMS バージョン 3.9.2 以下を対象としたエクスプロイトを Bash で再実装したものです。CSRF トークンベースの保護をバイパスしてパスワードのブルートフォースを可能にする脆弱性 CVE-2019-17240 を利用します。 元の Python スクリプトは ColdFusionX（Mayank Deshmukh） によって作成され、ここでは Bash ユーザー向けに使いやすさと進行状況の追跡機能を強化して移植しています。 脆弱性の詳細 発見者 : Rastating CVE :...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...

EUVD-2026-79180

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

PT-2026-92401

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

EUVD-2026-58389

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069

IBM i versions 7.3–7.6 are affected by CVE-2026-17069 due to improper validation of anti-CSRF tokens, enabling a remote authenticated attacker to bypass security restrictions (Impact: C/H; Privileges Required: Low; User Interaction: None). The vulnerability is tied to Digital Certificate Manager ...

PT-2026-71829

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions because of improper validation of anti-CSRF tokens. Cross-Site Request Forgery CSRF is a type of attack that tricks a victim into...

CVE-2026-8426

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepareremoteupgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade method to...

Exploit for Missing Authentication for Critical Function in Projectsend

ProjectSend CVE-2024-11680 Exploit This is a proof-of-concept...

CVE-2026-32756: Unrestricted Upload of File with Dangerous Type

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an...

Unauthenticated File Upload in Gogs

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research Summary Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any...

CVE-2025-59110: Cross-Site Request Forgery (CSRF)

Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account. Only version 4.1 was tested and confirme...

EUVD-2017-15028

Malware in sbrugna...

EUVD-2023-35760

Malicious code in bioql PyPI...

EUVD-2022-5521

Malicious code in bioql PyPI...

CVE-2021-21407

Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0...

CVE-2023-31452

A cross-site request forgery CSRF token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could...

Important: mailman

Issue Overview: Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's...