295 matches found
CVE-2026-25151 Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued...
GHSA-R666-8GJF-4V5F Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Summary Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. Impact A vulnerability in checkCSRF lets an attacke...
PT-2026-5852
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially...
Exploit for CVE-2026-1056
CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitr...
MiracleLinux 8 : mailman:2.1 (AXSA:2022-2979:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-2979:01 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover CVE-2021-44227 Tenable has extracted the preceding description block directly fr...
MiracleLinux 7 : mailman-2.1.15-30.el7.2 (AXSA:2021-2576:01)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2576:01 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token bypass allows to perform CSRF...
CVE-2026-23622 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from...
Cross-site Request Forgery (CSRF)
Overview label-studio-sso is a Native JWT authentication for Label Studio OSS - simple and secure SSO integration Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to an improper exemption in the JWTSSOSessionAuthentication mechanism that disables CSRF token...
CVE-2025-12535
The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces wprest to unauthenticated users via the 'wpajaxnoprivrest-nonce' action. While the plugin...
EUVD-2020-29331
Malware in sbrugna...
EUVD-2017-6818
Malware in sbrugna...
EUVD-2018-4344
Malware in sbrugna...
EUVD-2013-7181
Malware in sbrugna...
EUVD-2023-0044
Malicious code in bioql PyPI...
EUVD-2022-1143
Malicious code in bioql PyPI...
EUVD-2022-2499
Malicious code in bioql PyPI...
EUVD-2023-57056
Malicious code in bioql PyPI...
EUVD-2023-25035
Malicious code in bioql PyPI...