EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

CVE-2025-67651

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67651

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67651

The CVE-2025-67651 entry describes a Cross-Site Request Forgery (CSRF) flaw in multiple PHP Jabbers scripts. The root cause is missing CSRF tokens and/or improper SameSite attributes, allowing an attacker to perform actions in an authenticated user’s context, notably creating new admin accounts. ...

PT-2026-66749

Name of the Vulnerable Software and Affected Versions PHP Jabbers scripts affected versions not specified Description A Cross-Site Request Forgery CSRF issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using th...

CVE-2025-67651: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

PT-2026-63432

Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11 Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize...

PT-2026-63353

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens JWTs, ignoring the actual role of the acting user. In environments where the Token...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

PT-2026-61597

Name of the Vulnerable Software and Affected Versions HCL Commerce affected versions not specified Description A privilege escalation issue exists that could enable an attacker to perform unauthorized administrative operations, cause a denial of service, or disclose personal data of users...

CVE-2026-58319

CVE-2026-58319 concerns Apache Doris Frontend (FE) HTTP REST administrative APIs that were reachable without authentication. The available data states an unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially compromis...

CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...

CVE-2026-61502

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a...

FreeScout 跨站请求伪造漏洞

FreeScout is a lightweight and powerful free open-source help desk and shared inbox built using PHP Laravel framework by FreeScout Inc. Versions of FreeScout prior to 1.8.215 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the email OAuth disconnection being...

CVE-2026-35669

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform...

CVE-2026-2712 WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...

CVE-2019-25682

CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting crafted pages that submit POST requests to the users.php endpoint...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the admin/usermanipulate and admin/settings/generall endpoints. An attacker can perform unauthorized administrative actions by tricking an authenticated administrator into submitting crafted...

PT-2026-31980

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25 Description The software contains a privilege escalation issue in gateway-authenticated plugin HTTP routes. The issue incorrectly assigns operator.admin runtime scope, bypassing caller-granted scopes. This...

CVE-2026-32839

Edimax GS-5008PL firmware 1.00.54 and earlier is impacted by a cross-site request forgery (CSRF) vulnerability. The issue stems from lack of anti-CSRF tokens and insufficient request validation, enabling remote attackers to coerce logged-in administrators into performing actions via malicious pag...