Qwik 跨站请求伪造漏洞

Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.12.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from spelling errors in regular expressions, resulting in incorrect parsing of certain Content-Type headers...

Edimax EW-7438RPn 跨站请求伪造漏洞

The Edimax EW-7438RPn is a wireless signal extender produced by Edimax Corporation of Taiwan, China. Version 1.13 of the Edimax EW-7438RPn contains a cross-site request forgeing vulnerability. This vulnerability stems from a cross-site request forgeing flaw in the MAC filtering configuration...

WordPress plugin ThirstyAffiliates 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-6084

Name of the Vulnerable Software and Affected Versions WRC-X1500GS-B WRC-X1500GSA-B Description A cross-site request forgery issue exists in the product. If a logged-in user accesses a malicious page, unintended operations may be performed. Recommendations At the moment, there is no information...

📄 Casdoor 2.283.0 Cross Site Request Forgery

Casdoor version 2.283.0 suffers from a cross site request forgery vulnerability. Related CVE number: CVE-2023-34927. Exploit Title: Casdoor v2.283.0 2026-02-02 - Cross-Site Request Forgery CSRF Application: Casdoor Version: v2.283.0 Date: 03/02/2026 Exploit Author: Van Lam Nguyen Facebook:...

PT-2026-6247

Name of the Vulnerable Software and Affected Versions themelooks Enter Addons versions prior to 2.3.3 Description A Cross-Site Request Forgery CSRF issue exists in themelooks Enter Addons. This allows attackers to perform actions on behalf of authenticated users without their knowledge. The issue...

PT-2026-6229

Name of the Vulnerable Software and Affected Versions Copyscape Premium versions through 1.4.1 Description A Cross-Site Request Forgery issue exists in Copyscape Premium. This allows attackers to perform actions on behalf of an unsuspecting user. The issue affects Copyscape Premium. Recommendatio...

PT-2026-6255

Name of the Vulnerable Software and Affected Versions ThirstyAffiliates versions through 3.11.9 Description A Cross-Site Request Forgery CSRF issue exists in ThirstyAffiliates. This allows attackers to perform actions on behalf of authenticated users without their knowledge. The issue allows Cros...

WordPress plugin UsersWP 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Qwik 跨站请求伪造漏洞

Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from inconsistent interpretation of HTTP request headers by the server-side request processing logic, allowing remote attackers t...

PT-2026-6276

Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0 Description Qwik City’s server-side request handler inconsistently interprets HTTP request headers. This can be exploited by a remote attacker to bypass Cross-Site Request Forgery CSRF protections on forms using...

WordPress plugin Copyscape Premium 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-6218

Name of the Vulnerable Software and Affected Versions WpEvently versions through 5.1.1 Description A Cross-Site Request Forgery CSRF issue exists in WpEvently mage-eventpress. This allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations Update...

PT-2026-6191

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda AC7 firmware versions prior to V03.03.03.01 cn Description The web management interface lacks CSRF protections for administrative functions. The interface does not enforce anti-CSRF tokens or robust origin validation. This could...

CVE-2026-24007

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items creating artifact links from the release. This...

CVE-2026-25221 PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...

CVE-2026-25221 PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...

CVE-2026-25221

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...

WordPress Popup Box plugin <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change vulnerability

Cross-Site Request Forgery to Popup Status Change vulnerability discovered by w41bu1 - VNPT Cyber Immunity in WordPress Plugin Popup box versions = 6.1.1...

WordPress Categorify plugin <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory vulnerability

Cross-Site Request Forgery via categorifyAjaxDeleteCategory vulnerability discovered by Francesco Carlucci in WordPress Plugin Categorify versions = 1.0.7.4...