23190 matches found
CVE-2021-29349
CVE-2021-29349 CVE-2021-29349 CSRF para eliminar todos los mensajes en Mahara 20.10 Payload y crédito https://github.com/0xBaz...
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC Resumen PoC de CVE-2019-9787 CSRF WordPress versión 5.0 referencia No uses esto excepto con fines de prueba. Instalación root@kitploit: $ docker-compose up -d 1. accede a http://localhost:8080/ e instala WordPress. Solo tienes que crear una cuenta de administrador de WP. 2...
CVE-2025-70899
This repository contains the Proof of Concept demonstrating the missing CSRF protection vulnerability in PHPgurukul Online Course Registration System. 📄 View the complete PoC here: MissingCSRFprotectionpoc.md...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
Ozette Plugins - Cross-Site Request Forgery
An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...
CVE-2023-45857-Demo
Demo para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar en el dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Comprobar en las herramientas de desarrollo del navegador que la cookie XSRF-TOKEN se ha establecido...
CVE-2020-23590
CVE-2020-23590 OPTILINK E-PON "N.º DE MODELO: OP-XT71000N" con "VERSIÓN DE HARDWARE: V2.2"; & "VERSIÓN DE FIRMWARE: OPV3.3.1-191028" Vulnerabilidad encontrada en el "Optilink OP-XT71000N Versión de hardware: V2.2, Versión de firmware: OPV3.3.1-191028" que permite a un atacante remoto no autentica...
CVE-2018-8718
Título del Exploit : Jenkins Vulnerabilidad CSRF del plugin mailer - Enviar correo CSRF Fecha : 2018/06/05 Autor del Exploit : Yeom Geun Cheol Página del proveedor : https://jenkins.io/ Enlace del software : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi Versión: Versiones...
CVE-2024-51435
bloodbank Un sencillo PoC de csrf encontrado en Blood Bank System v 1.0...
vertx-web-xsrf
Resumen La implementación CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl en Vert.x Web no crea tokens CSRF únicos por sesión de usuario. Un sitio web malicioso aún puede realizar CSRF obteniendo un token CSRF válido y agregándolo a un formulario HTML, y luego enviando el formulario...
inference-gateway-PoC
inference-gateway: aviso de seguridad...
halo-cors-csrf-CVE-2026-67921
CVE-2026-67921: Configuración incorrecta de CORS en Halo CMS + Bypass de Protección CSRF — Ataque Combinado Resumen Existe una vulnerabilidad crítica de ataque combinado en las versiones de Halo CMS hasta la 2.25.4 debido a dos configuraciones de seguridad incorrectas: 1. Configuración incorrecta...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...
EUVD-2026-76198
Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...
EUVD-2026-76204
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62133
WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...
CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CVE-2025-36422)
Summary A cross-site request forgery vulnerability was addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID:CVE-2025-36422 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request...