EUVD-2026-95120

The Malcolm kiosk Flask application exposes a POST /scriptcall/ endpoint with zero authentication and wildcard CORS CORSapp. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network...

CVE-2026-107337

The Malcolm kiosk Flask application is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to an unauthenticated POST /script_call/[removed] endpoint paired with a wildcard CORS(app) configuration. An attacker can trick an operator's browser into executing unauthorized management command...

CVE-2026-107337 Cross-Site Request Forgery in Malcolm

The Malcolm kiosk Flask application exposes a POST /scriptcall/ endpoint with zero authentication and wildcard CORS CORSapp. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network...