MAGMI - Cross-Site Request Forgery

MAGMI Magento Mass Importer is vulnerable to cross-site request forgery CSRF due to a lack of CSRF tokens. Remote code execution via phpcli command is also possible in the event that CSRF is leveraged against an existing admin session. id: CVE-2020-5776 info: name: MAGMI - Cross-Site Request...

EUVD-2026-119669

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery...

CVE-2026-14963

IBM Cognos Command Center versions 10.2.4.1 and 10.2.5 are vulnerable to a Cross-Site Request Forgery (CSRF) (CWE-352) flaw. This vulnerability could allow a remote attacker to execute unauthorized processes. IBM recommends upgrading to version 10.2.5 FP1 IF5 to address the issue. Specifically, u...

CVE-2026-123545

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

CVE-2026-123494

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

EUVD-2026-119430

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

EUVD-2026-119379

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123494: go-vikunja vikunja: Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data…

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123545: OpenIdentityPlatform OpenAM: OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device…

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

PT-2026-140144

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

PT-2026-139826

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user t...

PT-2026-140099

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery...

PT-2026-139775

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

ConceptronicIPCam_MultipleVulnerabilities

Multiple vulnerabilities at Conceptronic IP Cameras with 0.61.X. web firmware. A CSRF and Denial of Service vulnerabilities have been found at Conceptronic IP Cameras. CVE| Description ---|--- CVE-2018-6407| Unauthenticated remote Denial of Service vulnerability CVE-2018-6408| CSRF allows to chan...

CVE-2024-57373

CSRF Vulnerability in LifestyleStore v1.0 📌 Overview This repository documents a Cross-Site Request Forgery CSRF vulnerability identified in the LifestyleStore v1.0 project. The flaw allows attackers to perform unauthorized actions on behalf of authenticated users, posing risks to data integrity...

CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High...

CVE-2026-121783

Cross-Site Request Forgery CSRF vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90...

CVE-2026-119484

Cross-Site Request Forgery CSRF vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

CVE-2026-121783 WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90...