Cross-Site Request Forgery (CSRF)

github.com/1panel-dev/1panel is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to missing CSRF protections such as anti-CSRF tokens or Origin/Referer validation, which allows an attacker to trick an authenticated user into submitting a malicious request to change the...

UBUNTU-CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

CVE-2025-68659

Summary of CVE-2025-68659 (Discourse) : A DoS at the application level exists in the username-change path. Versions before 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 are affected where sending large JSON payloads to PUT /u//preferences/username can cause server delays and resource exhaustion, degr...

CVE-2025-34410

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery CSRF vulnerability in the Change Username functionality available from the settings panel /settings/panel. The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can...

MiroTalk 安全漏洞

MiroTalk is a simple, secure, and fast real-time videoconferencing software from the individual developer Miroslav Pejic. A security vulnerability exists in MiroTalk versions prior to 9de226 that stems from improper access control and allows an attacker to arbitrarily change a username by sending...

CMSuno Code Injection Vulnerability

CMSUno is an easy and handy tool for creating one-page responsive websites. A code injection vulnerability exists in CMSuno 1.6.2. The vulnerability can be exploited to inject malicious PHP code as a "username" when changing a username and password, which can be used to run commands on the server...

WUZHI CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-09137)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS 4.1.0 exists cross-site request forgery vulnerability, an attacker can change the super administrator's username via index.php?m=core&f=panel&v=editinf to take advantage of this...