PT-2026-107753

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

EUVD-2025-211045

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

CVE-2025-70517

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

EUVD-2025-211050

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

PT-2026-107509

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description The trainer login view in wger is susceptible to Cross-Site Request Forgery CSRF, a condition where a malicious site tricks a user's browser into performing an unwanted action on a different website. This...

PT-2026-107541

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-26718

Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via ...

CVE-2026-105785: Unverified Password Change

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105706: Cross-Site Request Forgery (CSRF)

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...

CVE-2026-106216: Cross-Site Request Forgery (CSRF)

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105785

Prior to Joplin Server 3.7.2 , a vulnerability exists in the TokenModel.ts and UserModel.ts components. The system stores CSRF, account-confirmation, email-change, and password-reset tokens without distinguishing their specific purposes. This allows an attacker to use a leaked CSRF or confirmatio...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

Exploit for CVE-2026-41875

CVE-2026-41875 – Quick.Cart CSRF Admin Credential Change + Sto...

Exploit for CVE-2026-41875

CVE-2026-41875 – Quick.Cart CSRF Admin Credential Change + Sto...

Cross-Site Request Forgery (CSRF)

Apache JSPWiki is vulnerable to JSON Hijacking. The vulnerability is due to insecure handling of JSON responses, where the data can be accessed cross‑origin via a tag and attackers can exploit it to perform CSRF attacks and steal information...

BIT-MOODLE-2026-102588 Moodle: csrf in xml grade import

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code for a service page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the...