CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the absence of CSRF protection on state-changing endpoints when OAuth cookie-based authentication is in use. An attacker can trick an authenticated user into visiting a malicious page that issues forg...

CVE-2026-54459

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

The open-source static blog editor Qexo versions 4.0.0 through 4.2.0 is vulnerable to an authentication bypass in the init_step_api component. The /api/init_step/ endpoint lacks proper authorization and a setup-completion guard, allowing an unauthenticated requester with a valid CSRF token to res...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-54459

The web-based file manager FileRise is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 3.14.0 . The application fails to enforce the X-CSRF-Token header for the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php. This allows an attacker to potentially f...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-84312

The Nginx UI web interface for the Nginx web server is vulnerable to a login CSRF attack in versions prior to 2.4.1 . The root cause is that the GetCasdoorUri function uses a constant OAuth state value (the configured Casdoor application name), and the CasdoorCallback function fails to validate t...

CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...

CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...

CVE-2022-51020

Flower versions before 2.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that Tornado xsrf_cookies is disabled and the OAuth session cookie lacks the SameSite attribute. An attacker can trick an authenticated user into visiting a malicious page that perf...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

EUVD-2022-56064

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

CVE-2026-59977

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

DEBIAN-CVE-2026-107226

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...