CVE-2026-15046

LitExtension: Store to WooCommerce Migration WordPress plugin (through 1.2.5 ) is vulnerable to a CSRF attack that allows an attacker to overwrite the store-migration connector's authentication token. The root cause is a missing nonce verification before an administrative action that modifies the...

CVE-2026-15046 LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

CVE-2026-15046 LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

EUVD-2026-63908

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

BIT-GITLAB-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

EUVD-2026-63814

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

Exploit for CVE-2026-73570

CVE-2026-73570 Donate Help maintain this p...

CVE-2026-77391

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

PT-2026-79433

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token...

CVE-2026-67361: Cross-Site Request Forgery (CSRF)

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

CVE-2026-67360: Authorization Bypass Through User-Controlled Key

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-77029: Cross-Site Request Forgery (CSRF)

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

CVE-2026-15046: Cross-Site Request Forgery (CSRF)

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...

CVE-2026-77391: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

PT-2026-79288

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-67358: Authorization Bypass Through User-Controlled Key

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token...

PT-2026-79367

Name of the Vulnerable Software and Affected Versions LitExtension WordPress plugin versions prior to 1.2.6 Description The plugin fails to verify a nonce a unique token used to prevent replay attacks before performing an administrative action that overwrites the store-migration connector's...

PT-2026-79383

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

CVE-2026-66001

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...