46329 matches found
EUVD-2026-106892
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...
EUVD-2026-106896
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...
EUVD-2026-106999
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...
CVE-2026-114093
Versions of Trigger.dev prior to 4.5.6 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability involving the GET-based /logout endpoint . A remote attacker can trick an authenticated user into clicking an obfuscated, URL-encoded link, which triggers an automatic logout. This action re...
CVE-2026-114089
Trigger.dev versions prior to 4.5.2 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the CLI authorization-code flow. The root cause is that accessing the /account/authorization-code/
CVE-2026-112836
Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...
CVE-2026-112836
The VikRentCar WordPress plugin (e4jvikwp), versions up to and including 1.4.8 , is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to perform unauthorized actions on behalf of a victim user. While the impact is categorized as HIGH with a C...
EUVD-2026-105134
Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...
CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...
CVE-2020-29254
CVE-2020-29254 TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. ========================== Cross-Side-Request-Forgery CSRF: TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. This could allow an unauthenticated, remote attacker to conduct a...
CVE-2023-40868
CVE-2023-40868 Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. The vulnerability is a Cross-Site Request Forgery CSRF vulnerability in the mooSocial MooSocial Softwa...
CVE-2023-43147
CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...
CVE-2024-52402
🚀 Exploit for CVE-2024-52402: WordPress Exclusive Content Password Protect Plugin -un -p 🛠️ Options usage: CVE-2024-52402.py -h -u URL -un USERNAME -p PASSWORD Exploit for ECVE-2024-52402 By | Nxploit, Khaled ALenazi options: -h, --help show this help message and exit -u, --url URL Target WordPres...
Prestashop-CVE-2024-34716
Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...
CVE-2024-34958
CVE-2024-34957 idccms CSRF poc CVE-2024-34958 idccms CSRF poc...
CVE-2025-22963
Overview Cross-site request forgeryCSRF vulnerability in Teedy versions = v1.11 allows remote attackers to force an end user to change their user informationusername, password, etc... on the web application in which they're currently authenticated. Vulnerability User information change endpoint i...
CVE-2021-32159
..| CSRFtoCommandInjection1 |.. Description : Exploiting a Cross-site request forgery CSRF attack to get a Command Injection through the Webmin's Upload and Download feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's...
DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution
DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...
MAGMI - Cross-Site Request Forgery
MAGMI Magento Mass Importer is vulnerable to cross-site request forgery CSRF due to a lack of CSRF tokens. Remote code execution via phpcli command is also possible in the event that CSRF is leveraged against an existing admin session. id: CVE-2020-5776 info: name: MAGMI - Cross-Site Request...