CVE-2026-64791

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or...

Plone < 3.1 XSRF

The version of Plone installed on the remote host is prior to 3.1.0. It is, therefore, affected by multiple cross-site request forgery vulnerabilities. A flaw exists, allowing remote attackers to add arbitrary accounts via the joinform page and change the privileges of arbitrary groups via the...

Plone 3.3.x < 5.0 Multiple XSRF Vulnerabilities (HF 20151006)

The version of Plone installed on the remote host is prior to 5.0. It is, therefore, affected by multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface. CVE-2015-7293 Note that Nessus has not tested for these issues but has instead relied only on the application's...

CVE-2026-64821

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-50743

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

CVE-2026-50743

CVE-2026-50743 : Revive Adserver 6.0.7 contains a CSRF in the zone-include.php script that allows linking/unlinking banners or campaigns to zones via crafted GET/POST requests without CSRF token verification, enabling actions on behalf of an authenticated admin. Affected: Revive Adserver up to an...

CVE-2026-50743

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823

Summary: CVE-2026-32823 affects dataCycle-CORE (dataCycle data management system). Prior to version 26.06.08, the module handling core processing and framework rules exposed server-side state changes via GET routes. Because browsers send cookies on same-site top-level navigation and Rails does no...

CVE-2026-16216

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...

CVE-2026-16216

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...

CVE-2026-16216 geex-arts django-jet OAuth cross-site request forgery

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...

CVE-2026-16216

Geex-arts django-jet up to 1.0.8 contains a CSRF flaw in the OAuth Handler that can be exploited remotely. The vulnerability enables cross-site request forgery and is public, with no response from the project to the issue. The CVE reports a MEDIUM severity (CVSS 3.x/4.x family) and indicates no l...

CVE-2026-16216 geex-arts django-jet OAuth cross-site request forgery

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...

CVE-2026-16081

A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-16081

The CVE-2026-16081 vulnerability affects Sipeed PicoClaw versions up to 0.2.9, with the root cause in an unspecified function within web/backend/api/auth.go. A manipulation can lead to cross-site request forgery (CSRF) and can be triggered remotely. Public exploitation has been disclosed, and a p...

CVE-2026-16081 Sipeed PicoClaw auth.go cross-site request forgery

A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be...