181 matches found
CVE-2026-13159
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...
CVE-2026-13159
CVE-2026-13159 affects the Real Estate Papi WordPress theme through version 1.0.5 . The root cause is a missing capability and CSRF check on one of the theme's AJAX actions, which allows any authenticated user (as low as a subscriber) to install a fixed set of companion plugins from the WordPress...
CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...
EUVD-2026-31361
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protecti...
CVE-2026-7882 Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protecti...
owasp-web-pentest-tools
OWASP Web Pentest Tools CLI toolkit para suporte em testes de...
CVE-2022-0875
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks...
CVE-2022-0345
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfwsearchusers AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes finding the first letter, then the second one, then the third one...
CVE-2025-12696
CVE-2025-12696 affects the WordPress HelloLeads CRM Form Shortcode plugin (versions
EUVD-2021-11730
Malware in sbrugna...
EUVD-2021-11498
Malware in sbrugna...
EUVD-2021-11358
Malware in sbrugna...
EUVD-2021-11262
Malware in sbrugna...
EUVD-2021-11047
Malware in sbrugna...
EUVD-2021-11751
Malware in sbrugna...
EUVD-2021-11984
Malware in sbrugna...
EUVD-2021-11922
Malware in sbrugna...