EUVD-2026-96754

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

EUVD-2026-96756

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin (versions through 1.0.4 ) is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of authorization and CSRF checks on a REST endpoint, combined with a failure to verify that the updated option belongs to the ...

EUVD-2026-96735

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

xssless

xssless Un generatore automatico di payload XSS scritto in Python. Utilizzo 1. Registra le richieste con Burp proxy 2. Seleziona le richieste che vuoi generare, poi fai clic con il tasto destro e seleziona "Salva elementi" 3. Usa xssless per generare il tuo payload: ./xssless.py burpexportfile 4...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

CVE-2026-108738: Cross-Site Request Forgery (CSRF)

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-84254: Missing Authorization

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-84252: Missing Authorization

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84251: Missing Authorization

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-103305: Improper Neutralization of Input During Web Page Generation

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

PT-2026-110030

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Contact Form 7 WordPress plugin versions prior to 1.0.5 Description The software lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

PT-2026-110028

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to WPForms versions prior to 1.0.4 Description The add-on lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if the option being updated...

PT-2026-110027

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Ninja Forms versions prior to 1.0.2 Description The add-on lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option being...

CVE-2024-27631

CVE-2024-27631 Vulnerability Details Overview In Savane v3.12 and prior, a lack of CSRF protection on administrative functions can allow for privilege escalation and/or account takeover. In particular, the endpoint /siteadmin/usergroup.php includes the functionality to change the passwords and...

CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553 OpenRefine through 3.10.1 CSRF to RCE via get-rows Command

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553

OpenRefine versions through 3.10.1 are vulnerable to a Cross-Site Request Forgery (CSRF) in the get-rows command . This flaw allows a remote attacker to trick a user into visiting a malicious page that issues a cross-origin GET request with a crafted engine parameter . Successful exploitation ena...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Panoramica PoC della CVE-2019-9787 CSRF Versione WordPress 5.0 riferimento Non usarlo se non per scopi di test. Installazione $ docker-compose up -d 1. accedi a http://localhost:8080/ e installa WordPress. devi solo creare un account amministratore WP. 2. accedi a...