CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

Ozette Plugins - Cross-Site Request Forgery

An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...

CVE-2021-29349

CVE-2021-29349 CVE-2021-29349 CSRF to remove all messages in Mahara 20.10 Payload and Credit https://github.com/0xBaz...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Overview PoC of CVE-2019-9787 CSRF WordPress Version 5.0 refference Do not use this except for test purpose. Installation root@kitploit: $ docker-compose up -d 1. access http://localhost:8080/ and install WordPress. you only have to create WP admin account. 2. access...

EUVD-2026-76198

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

EUVD-2026-76204

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-62133

WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...

CVE-2024-51435

bloodbank A simple csrf poc found on blood bank system v 1.0...

CVE-2020-23590

CVE-2020-23590 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Vulnerability found in the "Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OPV3.3.1-191028" which allow an unauthenticated remote attacker to conduct a...

vertx-web-xsrf

Overview The CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl in Vert.x Web does not create CSRF Tokens that are unique per user session. A malicious website can still perform CSRF by obtaining a valid CSRF token and adding it to a HTML form and then submitting the form to the...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CVE-2025-36422)

Summary A cross-site request forgery vulnerability was addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID:CVE-2025-36422 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request...

CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google...

CVE-2025-70899

This repository contains the Proof of Concept demonstrating the missing CSRF protection vulnerability in PHPgurukul Online Course Registration System. 📄 View the complete PoC here: MissingCSRFprotectionpoc.md...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Configuración incorrecta de CORS en Halo CMS + Bypass de Protección CSRF — Ataque Combinado Resumen Existe una vulnerabilidad crítica de ataque combinado en las versiones de Halo CMS hasta la 2.25.4 debido a dos configuraciones de seguridad incorrectas: 1. Configuración incorrecta...

PT-2026-86954

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2018-8718

漏洞标题 : Jenkins mailer 插件 CSRF 漏洞 - 发送 CSRF 邮件 日期 : 2018/06/05 利用作者 : Yeom Geun Cheol 厂商主页 : https://jenkins.io/ 软件链接 : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi 版本 : 版本低于 1.20 1.1 1.20 测试环境 : Linux , Windows CVE : CVE–2018-8718 CVE-2018-8718 的 PoC + 工具...

CVE-2026-18780

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-81890

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin GeoDirectory versions = 2.8.176...