Debian dla-4832 : nagios4 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4832 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4832-1 [email protected]...

VulnCheck KEV: CVE-2024-1756

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2026-103076: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-89279: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4...

CVE-2025-28355

CVE-2025-28355 It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks, one of the many action an attacker can perform is trick a legitimate user to run a cross site request that will alter his/her password, allowing the attacker...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the absence of CSRF protection on state-changing endpoints when OAuth cookie-based authentication is in use. An attacker can trick an authenticated user into visiting a malicious page that issues forg...

CVE-2026-54459

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

The open-source static blog editor Qexo versions 4.0.0 through 4.2.0 is vulnerable to an authentication bypass in the init_step_api component. The /api/init_step/ endpoint lacks proper authorization and a setup-completion guard, allowing an unauthenticated requester with a valid CSRF token to res...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-54459

The web-based file manager FileRise is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 3.14.0 . The application fails to enforce the X-CSRF-Token header for the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php. This allows an attacker to potentially f...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-84312

The Nginx UI web interface for the Nginx web server is vulnerable to a login CSRF attack in versions prior to 2.4.1 . The root cause is that the GetCasdoorUri function uses a constant OAuth state value (the configured Casdoor application name), and the CasdoorCallback function fails to validate t...

CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...

CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...

CVE-2022-51020

Flower versions before 2.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that Tornado xsrf_cookies is disabled and the OAuth session cookie lacks the SameSite attribute. An attacker can trick an authenticated user into visiting a malicious page that perf...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...