CVE-2026-40471

hackage-server lacked Cross-Site Request Forgery CSRF protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abus...

CVE-2022-3024

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...

CVE-2017-5244

Routes used to stop running Metasploit tasks either particular ones or all tasks allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting...