Cross-Site Request Forgery (CSRF)

wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the lack of a CSRF token in the resetAction function of ConfigController.php, which allows an attacker to arbitrarily delete the victim user's annotations, entries and tags by sending GET requests ...