PT-2026-120174

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

PT-2026-120190

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx...

CVE-2026-109682

Metasploit Framework versions prior to 6.5.7 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue exists in the send_request_cgi! function, which allows HTTP requests to follow redirects to different hosts without restricting the destination. An attacker-controlled malicious HTTP se...

CVE-2026-113704

A vulnerability exists in a2aproject a2a-rs up to version 0.4.3 within the Push Notification Handler component. Specifically, the HttpPushSender function in the file crates/server/src/push_notification_sender.rs is susceptible to server-side request forgery (SSRF) due to the manipulation of the T...

CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request...

CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request...

CVE-2026-112836

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2026-112836

The VikRentCar WordPress plugin (e4jvikwp), versions up to and including 1.4.8 , is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to perform unauthorized actions on behalf of a victim user. While the impact is categorized as HIGH with a C...

CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

EUVD-2026-105134

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2020-29254

CVE-2020-29254 TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. ========================== Cross-Side-Request-Forgery CSRF: TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. This could allow an unauthenticated, remote attacker to conduct a...

CVE-2023-40868

CVE-2023-40868 Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. The vulnerability is a Cross-Site Request Forgery CSRF vulnerability in the mooSocial MooSocial Softwa...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

CVE-2023-43147

CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...

CVE-2024-52402

🚀 Exploit for CVE-2024-52402: WordPress Exclusive Content Password Protect Plugin -un -p 🛠️ Options usage: CVE-2024-52402.py -h -u URL -un USERNAME -p PASSWORD Exploit for ECVE-2024-52402 By | Nxploit, Khaled ALenazi options: -h, --help show this help message and exit -u, --url URL Target WordPres...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

CVE-2024-34958

CVE-2024-34957 idccms CSRF poc CVE-2024-34958 idccms CSRF poc...

TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...

EUVD-2026-104637

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112358

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...