67945 matches found
CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
EUVD-2026-92156
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
CVE-2026-105292
The software Chaterm before version 0.12.1 is vulnerable to a login cross-site request forgery (CSRF) . The root cause is a lack of OAuth state validation when processing chaterm:// callbacks. A remote attacker can trigger a crafted callback from a web page to inject attacker-controlled userInfo....
CVE-2026-104407: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9...
CVE-2026-105292: Cross-Site Request Forgery (CSRF)
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
PT-2026-104766
Name of the Vulnerable Software and Affected Versions PowerPress Podcasting versions prior to 11.17.10 Description Cross-Site Request Forgery CSRF allows an attacker to induce a user to perform actions they did not intend to do on the PowerPress Podcasting plugin. Recommendations Update PowerPres...
PT-2026-104666
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
PT-2026-106280
Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description In the packages/server/src/models/TokenModel.ts file, CSRF, account-confirmation, email-change, and password-reset tokens are stored without a designated purpose. Additionally, the...
CVE-2026-102776: Cross-Site Request Forgery (CSRF)
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...
CVE-2026-93549
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
EUVD-2026-92075
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
CVE-2026-93549
The CoCart WordPress plugin, in versions 4.9.0 through 4.9.6 , contains a vulnerability where it fails to scope its REST API authentication filter to its specific endpoints. This oversight disables the WordPress core REST nonce protection across all routes. An attacker can exploit this flaw to pe...
CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
PT-2026-104610
Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.7 Description The plugin fails to scope its REST API authentication filter to its own endpoints. This action disables the REST nonce protection provided by WordPress core for every route...
WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by ChuongVN in WordPress Plugin Featured Image from URL versions = 6.0.7...
CVE-2026-48611-EXPLOIT
CVE-2026-48611 – phpBB OAuth 계정 탈취 익스플로잇 인증 없는 계정 탈취 | CVSS 9.4 치명적 | 즉시 사용 가능 🔥 제공 항목 완벽하게 작동하는 Python 익스플로잇 — CVE-2026-48611용 대량 스캐너 — 수천 개의 대상 자동 점검 CSRF 페이로드 생성기 — 계정 탈취용 HTML 파일 생성 취약한 대상 반환 — 버전 및 OAuth 공급자 정보 포함 phpBB 3.3.0 3.3.16 에서 OAuth 활성화 시 작동 Google, Facebook, Bitly 기본적으로 무소음, 클린, 로그...