273 matches found
PT-2026-5852
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially...
Exploit for CVE-2026-1056
CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitr...
MiracleLinux 8 : mailman:2.1 (AXSA:2022-2979:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-2979:01 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover CVE-2021-44227 Tenable has extracted the preceding description block directly fr...
MiracleLinux 7 : mailman-2.1.15-30.el7.2 (AXSA:2021-2576:01)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2576:01 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token bypass allows to perform CSRF...
CVE-2026-23622 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from...
Cross-site Request Forgery (CSRF)
Overview label-studio-sso is a Native JWT authentication for Label Studio OSS - simple and secure SSO integration Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to an improper exemption in the JWTSSOSessionAuthentication mechanism that disables CSRF token...
CVE-2025-12535
The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces wprest to unauthenticated users via the 'wpajaxnoprivrest-nonce' action. While the plugin...
EUVD-2020-29331
Malware in sbrugna...
EUVD-2017-6818
Malware in sbrugna...
EUVD-2013-7181
Malware in sbrugna...
EUVD-2018-4344
Malware in sbrugna...
EUVD-2022-1143
Malicious code in bioql PyPI...
EUVD-2023-0044
Malicious code in bioql PyPI...
EUVD-2023-57056
Malicious code in bioql PyPI...
EUVD-2022-2499
Malicious code in bioql PyPI...
EUVD-2023-25035
Malicious code in bioql PyPI...
EUVD-2022-2431
Malicious code in bioql PyPI...
EUVD-2022-5270
Malicious code in bioql PyPI...
CVE-2025-7040
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...
Linux Distros Unpatched Vulnerability : CVE-2020-35239
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks b...