PT-2026-89124

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738

Snipe-IT versions before 8.7.0 are affected by a CSS injection vulnerability in the Custom CSS field . The root cause is incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. A superuser can plant malicious CSS payloads using @import and url() references...

EUVD-2026-72874

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in deleteHistory.json.php and finishAll.json.php . The root cause is the absence of CSRF token validation on GET requests , allowing unauthenticated attackers to craft ma...

CVE-2026-33920

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

PT-2026-87079

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

PT-2026-87115

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

PT-2026-87135

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

Use of Single-factor Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication through the removeTwofactorConfig process and the twofactorenabled form field, which are accessible via POST...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85590

phpMyFAQ before 4.1.8 contains an authentication bypass in its two-factor (TOTP) disable functionality . The removeTwofactorConfig() handler at POST /api/user/remove-twofactor checks only session and CSRF token, then disables TOTP without requiring password re-entry or a current TOTP code. The sa...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...