EUVD-2026-62501

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

CVE-2026-75949 Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-75949

The J-BusinessDirectory Joomla extension by cmsjunkie.com (versions prior to 6.2.3 ) is vulnerable to arbitrary file upload and deletion via a path traversal flaw. The application accepts a client-controlled root for file operations, fails to enforce path containment, and employs a weak extension...

EUVD-2026-62489

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-75949 Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-74804

creationtimestamp| type| source ---|---|--- 2026-08-19 14:04:01+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2kahc2s 2026-08-19 14:04:02+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2lbns2s 2026-08-19 16:08:24+00:00| seen|...

CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

EUVD-2026-62397

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

EUVD-2026-62396

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

CVE-2026-67363

The stripeCharges and payAuthorize endpoints in Balbooa Forms (versions before 2.4.3.2) accept the charge total from a client-controlled parameter without recomputing it from configured prices and lack authentication or CSRF checks. An unauthenticated attacker can purchase priced items for arbitr...

CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

PYSEC-2026-3688 MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

MobSF's CSRF checks not enforced after Django migration

SummaryDjango's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

WordPress Google Authenticator plugin < 0.56 - 2FA Secret Overwrite via CSRF vulnerability

2FA Secret Overwrite via CSRF vulnerability discovered by Miguel Mendez Z in WordPress Plugin Google Authenticator versions 0.56...

BIT-KIBANA-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

EUVD-2026-62209

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

PT-2026-78722

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-76334: Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

CVE-2026-63123: Cross-Site Request Forgery (CSRF)

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...