CVE-2021-29349

CVE-2021-29349 CVE-2021-29349 Mahara 20.10에서 모든 메시지를 제거하는 CSRF 페이로드 및 크레딧 https://github.com/0xBaz...

Ozette Plugins - Cross-Site Request Forgery

An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

CVE-2024-51435

bloodbank Простой csrf poc, найденный в системе банка крови v 1.0...

CVE-2023-45857-Demo

Демонстрация уязвимости axios CVE-2023-45857 1. Запустить в dev container 2. В контейнере app выполнить npm run dev 3. Перейти по адресу http://app.localhost 4. В инструментах разработчика браузера убедиться, что в Cookie установлен XSRF-TOKEN Значение равно CREDENTIALTOKEN HttpOnly = false...

CVE-2026-77568 Mojolicious: CSRF tokens are vulnerable to BREACH attacks

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Обзор PoC уязвимости CVE-2019-9787 CSRF Версия WordPress 5.0 ссылка Не используйте это, кроме как для тестирования. Установка root@kitploit: $ docker-compose up -d 1. зайдите на http://localhost:8080/ и установите WordPress. Вам достаточно создать учётную запись...

CVE-2020-23590

CVE-2020-23590 OPTILINK E-PON "МОДЕЛЬ: OP-XT71000N" с "ВЕРСИЯ АППАРАТНОГО ОБЕСПЕЧЕНИЯ: V2.2" и "ВЕРСИЯ ПРОШИВКИ: OPV3.3.1-191028" Уязвимость обнаружена в "Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OPV3.3.1-191028", которая позволяет неавторизованному удаленному злоумышленник...

vertx-web-xsrf

개요 io.vertx.ext.web.handler.impl.CSRFHandlerImpl Vert.x Web의 CSRFHandlerImpl은 사용자 세션별로 고유한 CSRF 토큰을 생성하지 않습니다. 악의적인 웹사이트는 유효한 CSRF 토큰을 획득하여 HTML 폼에 추가한 후 취약한 웹 애플리케이션에 폼을 제출함으로써 CSRF를 여전히 수행할 수 있습니다. 현재, 사전 검증pre-flight CORS OPTIONS HTTP 요청이 XMLHTTPRequests를 통한 CSRF를 방지하지만, 사전 검증 요청을 우회할 수 있는 방법이...

inference-gateway-PoC

inference-gateway: 보안 권고...

CVE-2025-70899

Этот репозиторий содержит Подтверждение концепции, демонстрирующее уязвимость отсутствия защиты от CSRF в системе регистрации онлайн-курсов PHPgurukul. 📄 Посмотреть полное PoC здесь: MissingCSRFprotectionpoc.md...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS 오설정 + CSRF 보호 우회 결합 공격 요약 Halo CMS 2.25.4 이하 버전에는 두 가지 보안 오설정으로 인한 심각한 결합 공격 취약점이 존재합니다: 1. CORS 오설정 : CORS 정책이 credentials: true와 함께 모든 오리진을 허용합니다. 2. CSRF 보호 우회 : 모든 API 엔드포인트/api/, /apis/가 CSRF 보호에서 제외됩니다. 이 두 가지가 결합되면, 공격자는 CORS가 강제하도록 설계된 Same-Origin Policy 보호를...

CVE-2018-8718

Exploit Title : Jenkins CSRF-уязвимость плагина mailer - Отправка CSRF-почты Date : 2018/06/05 Exploit Author : Yeom Geun Cheol Vendor Homepage : https://jenkins.io/ Software Link : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi Version: Ниже версии 1.20 1.1 1.20 Tested on :...

EUVD-2026-76198

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

EUVD-2026-76204

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-62133

WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CVE-2025-36422)

Summary A cross-site request forgery vulnerability was addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID:CVE-2025-36422 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request...

CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-86954

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-18780

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...