ROS-20260908-73-0033

The vulnerability in golang-x-net is related to the lack of protective measures for website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-50669

uBB.threads is vulnerable to a Cross-Site Request Forgery CSRF due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version...

CVE-2026-36960

A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...

CVE-2026-36956

A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An...

GLPI JavaScript Code Execution

The vulnerability of the JavaScript file taskjobs.js in the GLPI system for managing requests, incidents, and inventory of computer equipment is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Cisco Integrated Management Controller XSS

The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

IBM QRadar SIEM Cross-site Scenario Attacks

The vulnerability of the IBM QRadar SIEM event collection and analysis web interface is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Cross-Site Request Forgery (CSRF)

github.com/1panel-dev/1panel is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to missing CSRF protections such as anti-CSRF tokens or Origin/Referer validation, which allows an attacker to craft a malicious webpage that triggers unauthorized panel name changes when a...

CVE-2026-24432 Tenda W30E V2 Missing CSRF Protections for Administrative Actions

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 lack cross-site request forgery CSRF protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered b...

Office Online Package XSS

The vulnerability of the office online package ONLYOFFICE Docs DocumentServer is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Instant Search XSS

The vulnerability of the Instant Search function in the Content Search module of the ManageEngine Exchange Reporter Plus software exists because measures to protect the website structure have not been taken. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

CVE-2025-64760 Tuleap has missing CSRF protections in its tracker trigger management system

Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove track...

Nagios XI XSS

The vulnerability of the update checking function in the Nagios XI IT infrastructure monitoring tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...

SUSE CVE-2016-11071

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place...

Splunk Web Arbitrary JavaScript Execution

The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

Nagios XI Favorites CSRF

The vulnerability of the Favorites component in the Nagios XI monitoring tool relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...

Reward System. Loyalty Programs Arbitrary JavaScript Execution

Vulnerability of “Reward System. Loyalty Programs”. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code in the administrative panel interface...

Blue Mail XSS

The vulnerability of the Blue Mail email client is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Documino Automation Platform SQL Injection Privilege Escalation

The vulnerability of the Documino automation platform for electronic document processing lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow attackers to enhance their privileges by sending specially crafted SQL queries...