WS-2023-0407

CSRF edit Blacklist settings YES to NO in limesurvey/limesurvey...

WS-2023-0413

CSRF in Save Box Settings in limesurvey/limesurvey...

WS-2023-0348

CSRF in Question Themes function in limesurvey before 6.2.8+230921...

WS-2023-0272

Cross-Site Request Forgery CSRF in GitHub repository admidio/admidio prior to 4.2.10...

WS-2023-0238

CSRF in the delete notification function in limesurvey/limesurvey...

WS-2023-0229

CSRF Leading to reset Boxes in limesurvey/limesurvey...

Admidio PKCS#12 private key export action lacks CSRF protection

Summary The sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a...

GHSA-XG76-5QJ2-2HHV Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Summary modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a...

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Summary modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember, assignuser, deleteuser, createuser calls...

CVE-2026-45610

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...

WS-2023-0021

CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data...

WS-2022-0417

Unintended API key generation in froxlor/froxlor. The API keys sections are vulnerable to CSRF. The aggressor can generate the key on the admin's account without prior knowledge of admin credentials. The successful CSRF will generate new keys on the admin's account...

WS-2022-0418

CSRF on SSL certificates deletion in froxlor/froxlor...

WS-2022-0341

Cross-Site Request Forgery CSRF in thorsten/phpmyfaq. An attacker is able to log out a user if a logged-in user visits the attacker's website...

WS-2022-0059

In symfony the application sensible to CSRF attacks before versions 5.3.15,5.4.4 and 6.0.4...

CVE-2018-25397: Cross-Site Request Forgery (CSRF)

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST...

CVE-2026-6075: Cross-Site Request Forgery (CSRF)

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an...

CVE-2018-25387: Cross-Site Request Forgery (CSRF)

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksiuser.php script with parameters like iduser, password, and leve...

PT-2026-45039

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10 Description Cross-Site Request Forgery CSRF exists in the modules/sso/clients.php endpoint. The enable case fails to validate the adm csrf token and accepts requests via GET parameters. This allows an attacker ...

PT-2026-45042

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10 Description An issue exists where the mode=export action in the modules/sso/keys.php endpoint exports a PKCS12 bundle containing the configured private key and certificate without proper Cross-Site Request...