CVE-2026-45127

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

EUVD-2026-60977

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127

MyBB versions prior to 1.8.40 have a CSRF flaw in the ACP Mass Mail Resend route: the admin/modules/user/mass_mail.php endpoint duplicates archived entries into new drafts (setting mybb_massemails.status = 0) on unprotected GET requests. A same-site attacker can trigger this via a crafted URL. Up...

CVE-2026-45127

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-66635

Cross-Site Request Forgery CSRF vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66635

WordPress Slider by 10Web plugin (versions ≤ 1.2.62) contains a CSRF vulnerability allowing an unauthenticated attacker to trick an authenticated user into deleting arbitrary files on the server. The flaw stems from missing CSRF protection on file-deletion actions. Impact is availability-focused ...

CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63...

webpack-dev-server CVE-2026-14620 open-editor CSRF check

CVE-2026-14620 GHSA-f5vj-f2hx-8m93: webpack-dev-server = 5.2.5 allows cross-site requests to GET /webpack-dev-server/open-editor?fileName=, which calls launchEditor and can spawn an editor on an attacker-chosen path. The CVE-2026-6402 guard only blocks no-cors subresources; cross-site navigations...

webpack-dev-server CVE-2026-14620 open-editor CSRF detect

Detects CVE-2026-14620 in webpack-dev-server = 5.2.5: cross-site GET /webpack-dev-server/open-editor?fileName= reaches launchEditor. Probes cors and no-cors Sec-Fetch combinations; vulnerable when cors cross-site returns HTTP 200 while no-cors cross-site is blocked 403. !/usr/bin/env python3 --...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

CSRF to Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.62...

CVE-2026-75151

SourceCodester Online Examination & Learning Management System 1.0 has a CSRF vulnerability in an unspecified function. No patch version or workaround is provided. No in-the-wild exploitation details are available. CVSS 3.1 base score 4.3 (MEDIUM), network vector, user interaction required. No af...

CVE-2026-75151 SourceCodester Onlne Examination & Learning Management System cross-site request forgery

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

PT-2026-77063

Name of the Vulnerable Software and Affected Versions Slider by 10Web versions prior to 1.2.63 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to force an authenticated user to execute unwanted actions on the web application. Recommendations...

PT-2026-77173

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/syste...

PT-2026-77181

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...