67905 matches found
CVE-2026-108481 WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin Patreon WordPress versions = 1.10.0...
CVE-2026-85960
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...
CVE-2026-85960 Cross-site request forgery in Progress MarkLogic Server Query Console
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...
EUVD-2026-97674
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...
CVE-2026-109319
The Grav Guestbook plugin versions 0.5.0 and 0.5.1 are vulnerable to missing authorization and cross-site request forgery (CSRF) within the Admin moderation actions, specifically for delete , approve , and approveAll . The root cause allows authenticated Admin users without the admin.guestbook pe...
CVE-2026-109319 Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...
CVE-2026-109319 Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...
CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...
EUVD-2026-97618
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...
CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...
CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...
CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...
CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...
UBUNTU-CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...
UBUNTU-CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...
CVE-2026-78358
The OTRS help desk software (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and Community Edition 6.x and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is the lack of ChallengeToken validation on several administrative endpoints, specifical...
EUVD-2026-97268
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...
CVE-2026-78358 Cross-Site Request Forgery in Administrative Actions
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...