CVE-2018-25200 OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and ro...

CVE-2018-25200

CVE-2018-25200 concerns OOP CMS BLOG 1.0 with a cross-site request forgery that lets unauthenticated attackers craft POST requests to addUser.php (parameters: userName, password, email, role) to create an administrative account. Connected sources consistently describe the flaw and its target endp...

CVE-2018-25190 Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...

CVE-2018-25190

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...

CVE-2018-25190 Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...

CVE-2018-25168 Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2018-25168 Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests to the /public/admin/user/submitnew endpoint without CSRF tokens. The issue stems from missing CSRF pro...

CVE-2026-28465

creationtimestamp| type| source ---|---|--- 2026-03-06 11:21:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf6zzcvux2n...

CVE-2026-28469

creationtimestamp| type| source ---|---|--- 2026-03-06 11:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xbd7qk2s...

CVE-2026-1468

creationtimestamp| type| source ---|---|--- 2026-03-06 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2026-1468/ 2026-03-06 11:54:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfaw44vnm2o 2026-07-28 16:45:02+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-63...

CVE-2026-28473

creationtimestamp| type| source ---|---|--- 2026-03-06 10:17:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3hqrqru2k...

CVE-2026-3589

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589

The WooCommerce WordPress plugin (versions 5.4.0 through 10.5.2 ) contains a vulnerability where it does not properly handle batch requests . This flaw could allow unauthenticated users to trick a logged-in administrator into making calls to non-store WC REST endpoints . For example, an attacker ...

CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-2830

creationtimestamp| type| source ---|---|--- 2026-03-06 08:49:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgewkafcm227...

CVE-2026-30869

creationtimestamp| type| source ---|---|--- 2026-03-06 08:41:37+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w 2026-03-10 00:00:59+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201936937270822...