68736 matches found
CVE-2026-12746
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...
CVE-2026-12746
The Dancer2::Plugin::Auth::OAuth::Provider Perl plugin (versions before 0.23 ) lacks support for the OAuth 2.0 state parameter . Specifically, the authentication_url method fails to issue a state value, and the callback method registers tokens without verifying that the callback matches the sessi...
CVE-2026-12746: Cross-Site Request Forgery (CSRF)
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...
CVE-2026-12740: Cross-Site Request Forgery (CSRF)
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session...
PT-2026-55495
Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...
PT-2026-116264
Уязвимость функций GetCasdoorUri и CasdoorCallback пользовательского интерфейса Nginx UI сервера nginx связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить CSRF-атаку...
CVE-2026-14620: Cross-Site Request Forgery (CSRF)
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...
Kallithea Routes CSRF Bypass
Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method...
Cobbler Web Interface Lacks CSRF Protection
cobbler: Web interface lacks CSRF protection when using Django framework...
CVE-2026-57757
Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...
CVE-2026-57759 WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2...
CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Permalink Manager for WooCommerce = 1.0.8.2 versions...
CVE-2026-57751
The CVE-2026-57751 entry concerns the WordPress plugin Heateor Social Login (versions
CVE-2026-57759: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2...
CVE-2026-57758: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Permalink Manager for WooCommerce = 1.0.8.2 versions...
CVE-2026-57747: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57690: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...
CVE-2026-57757: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...