CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 CSRF Vulnerability: Leads to Creating Fake Clients Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/ Vulnerability Name : Cross-Site Request ForgeryCSRF Affected Version : V1.2 Introduction A Cross-Site Request Forgery CSRF vulnerability...

cve-2016-4845_csrf

cve-2016-4845csrf Proof of concept for CSRF vulnerabilityCVE-2016-4825 on IO-DATA Recording Hard Disc Drive. License These codes are released under the MIT License. Please see LICENSE.txt...

CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 Reference report: GHSA-pgpj-v85q-h5fm This repository contains a docker compose configuration that setups both a pyLoad server and an attacker server that just provides a csrf.html. To test yourself, just run docker composer up you need to have docker composer installed additionall...

CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87449

CVE-2026-87449 is a cross-site request forgery (CSRF) vulnerability in DeviceBoundSessionCredentials within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker could bypass the web origin policy by serving a crafted HTML page to a user, requiring user interaction (CVSS 4...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...

cve-2020-23127-PoC

cve-2020-23127-PoC CVE-2020-23127: https://www.cvedetails.com/cve/CVE-2020-23127/ Introduction This is my first CVE proof of concept and analysis. It was done as part of my cyber-security course on my 2nd year of Master in Computer Sciences at Université de Franche-Comté. I looked specifically fo...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 Exploit Title: Vehicle Service Management System - 'Multiple' Cross-Site Request Forgery CSRF Leads to Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM References:...

CVE-2025-67315

CSRF to Deactivate Any Employee Summary The Manage Employees functionality is vulnerable to Cross-Site Request Forgery CSRF. An attacker can trick a logged-in admin into sending a forged request that inactivates an employee e.g., inid=1 without the admin’s knowledge or consent. CVSS Base Score: 5...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Welcome to the official repository documenting the discovery and details of CVE-2025-26206 , a critical Cross-Site Request Forgery CSRF vulnerability in Sell Done Storefront v.1.0. Discovered by B. Sibhi , this...

CVE-2020-23588

CVE-2020-23588 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" allows an unauthenticated, remote attacker to conduct a cross-sit...

CVE-2026-9215 A CSRF vulnerability exists in certain NETGEAR XR series devices

A cross site request forgery CSRF vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is...

CVE-2026-86724

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a cross-site request forgery (CSRF) vulnerability in plugin/YPTWallet/view/saveBalance.php . The flaw arises because the endpoint relies solely on session cookies without token validation , allowing an attacker to craft a m...

EUVD-2026-72855

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in deleteHistory.json.php and finishAll.json.php . The root cause is the absence of CSRF token validation on GET requests , allowing unauthenticated attackers to craft ma...

CVE-2026-86135 Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-86135

WatchGuard Dimension is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its database snapshot creation feature. A remote attacker can trick an authenticated administrator into visiting a specially crafted web page, triggering unauthorized snapshot creation that leads to Denial of...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...