EUVD-2026-89727

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-102588 Moodle: csrf in xml grade import

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-102588

A vulnerability in Moodle allows a remote attacker to perform unauthorized actions via a Cross-Site Request Forgery (CSRF) flaw in the XML grade import feature. Because the feature lacks proper CSRF token validation , an attacker can trick an authenticated user with grade management permissions i...

CVE-2026-102588

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-91832

The WP Mobile Menu WordPress plugin (versions before 2.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to correctly verify the nonce during the settings import process. An attacker can exploit this via a cross-site request during an administrator's session to ...

PT-2026-103266

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

PT-2026-103222

Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...

CVE-2026-97299: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

PT-2026-103145

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

CVE-2026-102588: Origin Validation Error

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-102399: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

CVE-2026-96838: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...

PT-2026-103096

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. CSRF is a flaw that allows an attacker to trick an authenticated user into performing actions they d...

DEBIAN-CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-73597

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of...