102890 matches found
CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...
CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission...
CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens...
CVE-2026-64876
The Joomla Extension by regularlabs.com (specifically the GeoIP extension ) contains a vulnerability due to inconsistent CSRF token checks and privilege checks . Specifically, database-update requests failed to consistently verify tokens and Super User privileges, which could allow an attacker to...
EUVD-2026-47915
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
Server-Side Request Forgery
Spring Boot Admin Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied healthUrl and managementUrl parameters during instance registration, allowing unauthenticated attackers to force the server to send HTTP requests to...
WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log versions = 5.6.4...
WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 43.2 - Cross-Site Request Forgery to Privilege Escalation vulnerability
Cross-Site Request Forgery to Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPO365 versions = 43.2...
PT-2026-64169
Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...
PT-2026-63888
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-15212: Cross-Site Request Forgery (CSRF)
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
PT-2026-64159
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax Service::verify ajax request helper gating its wp verify nonce call behind the boolean option 'enable nonce check', which is absent from the default...
PT-2026-63928
Name of the Vulnerable Software and Affected Versions WP Activity Log versions prior to 5.6.5 WP Activity Log Premium versions prior to 5.6.5 Description Cross-Site Request Forgery CSRF occurs when an attacker tricks a victim into performing an action they did not intend to do. This issue is caus...
PT-2026-63600
Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder...
PT-2026-63893
Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...
PT-2026-64133
SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrape page validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...
PT-2026-64132
Summary A Server-Side Request Forgery SSRF vulnerability in the SearxNG / search web search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxng url argument is passed directly to requests.get with no validation of...