CVE-2017-9934

CVE-2017-9934 I am the reporter of this exploit, under name: Envo Joomla 1.7.3 - 3.7.2 CSRF exploit PoC This vulnerability works due to Joomla versions 1.7.3 to 3.7.2 not sanitizing base64 input. Headers: POST...

CVE-2023-7028

CVE-2023-7028: CVE-2023-7028 Exploitation Tool Description: This Python script automates the exploitation of a hypothetical security vulnerability CVE-2023-7028 on GitLab instances. It facilitates password reset attacks on specified target email addresses, demonstrating a potential security risk...

CSRFBrute

CSRFBrute CSRF登录暴力破解工具 - V 0.5.0 Dev 建议优先使用 csrfbrute.py 稳定精简版 🚀 特性 动态CSRF Token刷新 - 确保高安全性目标上的准确性 线程安全会话管理 - 支持高并发操作，最高100线程 智能重试机制 - 指数退避策略，提高成功率 会话恢复功能 - 支持断点续传和Cookie恢复 性能监控 - 实时统计信息和内存优化 安全审计 - 完整的日志记录和脱敏处理 🛠️ 技术架构 语言 : Python 3 架构 : 面向对象设计，模块化结构 并发 : ThreadPoolExecutor线程池 配置 :...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...

CVE-2024-50335

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation Summary The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2026-100524

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

EUVD-2026-87379

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management system built using PHP and MySQL. Auditor Shoaib Alam - LinkedIn Profile Description CSRF Vulnerability in Profile Update Section A Cross-Site Request Forgery CSRF vulnerability has been identified in the Gym Management System. This issue is...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit Exploiting TP-Link Archer CR-700 Router. Responsibly Disclosed to TP-Link Step 1- On you linux machine Kali or Ubuntu type the following command gedit /etc/dhcp/dhclient.conf Comment out the line below send host-name = gethostname; Copy it to the line below it an...

CVE-2026-85289

The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...

CVE-2026-85289 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...

ExtendedMacro

ExtendedMacro ExtendedMacro es un complemento para el proxy de BurpSuite. Proporciona una funcionalidad similar pero extendida de la función de Macro de BurpSuite. La funcionalidad principal es que puedes activar una o más solicitudes antes de cada solicitud activada desde Intruder, Repeater,...

CVE-2026-48060

CVE-2026-48060 - Litestar HTML Injection Through CSRF Token This repo contains the proof of concept exploit and vulnerable application to demonstrate the HTML injection vulnerability present in version 2.21.0 of Litestar. How to Run git clone https://github.com/Blinky-Keys/CVE-2026-48060 cd...

Exploit-CSRF-on-SCOPIA-XT-Desktop-version-8.3.915.4

Exploit CSRF on SCOPIA XT Desktop version 8.3.915.4 This PoC will be describe how to explore Cross-Site Request CSRF Forgery on SCOPIA XT Desktop version 8.3.915.4 About SCOPIA website: https://support.avaya.com/products/P1421/scopia-desktop/8.2.1 About Cross-Site Request Forgery CSRF Cross-site...

CVE-2026-97062

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the...

CVE-2026-97062 Aureus ERP through 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the...

CVE-2026-97062 Aureus ERP through 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the...