CVE-2018-25190

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2018-25168 Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests to the /public/admin/user/submitnew endpoint without CSRF tokens. The issue stems from missing CSRF pro...

CVE-2018-25168 Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2026-28465

creationtimestamp| type| source ---|---|--- 2026-03-06 11:21:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf6zzcvux2n...

CVE-2026-28469

creationtimestamp| type| source ---|---|--- 2026-03-06 11:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xbd7qk2s...

CVE-2026-1468

creationtimestamp| type| source ---|---|--- 2026-03-06 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2026-1468/ 2026-03-06 11:54:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfaw44vnm2o 2026-07-28 16:45:02+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-63...

CVE-2026-28473

creationtimestamp| type| source ---|---|--- 2026-03-06 10:17:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3hqrqru2k...

CVE-2026-3589

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589

CVE-2026-3589 affects the WordPress WooCommerce plugin, versions 5.4.0 through 10.5.2. The issue arises from improper handling of batch requests, enabling unauthenticated users to invoke admin-level REST endpoints and potentially create arbitrary admin users via CSRF. Evidence from multiple sourc...

CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example...

CVE-2026-2830

creationtimestamp| type| source ---|---|--- 2026-03-06 08:49:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgewkafcm227...

CVE-2026-30869

creationtimestamp| type| source ---|---|--- 2026-03-06 08:41:37+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w 2026-03-10 00:00:59+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201936937270822...

CVE-2026-23925

The CVE-2026-23925 issue affects Zabbix where an authenticated User with template/host write perms can misuse configuration.import to create unauthorized objects, leading to confidentiality loss (e.g., unauthorized hosts). Public sources corroborate an authorization bypass in Zabbix frontend/API ...

CVE-2026-23925 Unauthorized host creation via configuration.import API by low-privilege user with write permissions

An authenticated Zabbix user User role with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even...

CVE-2026-29068

creationtimestamp| type| source ---|---|--- 2026-03-06 08:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeu6smysm2o...

CVE-2026-28799

creationtimestamp| type| source ---|---|--- 2026-03-06 07:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgetcdbnqw2z 2026-05-06 14:30:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3ml6w2wjym52c...