22769 matches found
CVE-2020-23590
CVE-2020-23590 OPTILINK E-PON "МОДЕЛЬ: OP-XT71000N" с "ВЕРСИЯ АППАРАТНОГО ОБЕСПЕЧЕНИЯ: V2.2" и "ВЕРСИЯ ПРОШИВКИ: OPV3.3.1-191028" Уязвимость обнаружена в "Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OPV3.3.1-191028", которая позволяет неавторизованному удаленному злоумышленник...
Ozette Plugins - Cross-Site Request Forgery
An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
CVE-2023-45857-Demo
axios の脆弱性 CVE-2023-45857 の動作を確認するデモ 1. dev container で起動する 2. app コンテナでnpm run devする 3. http://app.localhostへアクセスする 4. ブラウザの開発者ツールで Cookie にXSRF-TOKENがセットされていることを確認する 値がCREDENTIALTOKENとなっていること HttpOnly が false となっていること SameSite が Strict となっていること 5. ボタンを押す 6...
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC 개요 CVE-2019-9787 CSRF의 PoC WordPress 버전 5.0 참고 테스트 목적 외에는 사용하지 마십시오. 설치 root@kitploit: $ docker-compose up -d 1. http://localhost:8080/에 접속하여 WordPress를 설치합니다. WP 관리자 계정만 생성하면 됩니다. 2. 방문자로서 http://localhost:8080/?p=1comments에 접속하여 "csrf site: http://localhost/" 같은 댓글을 작성합니다...
CVE-2021-29349
CVE-2021-29349 CVE-2021-29349 CSRF для удаления всех сообщений в Mahara 20.10 Пейлоад и авторство https://github.com/0xBaz...
CVE-2024-51435
bloodbank 血液銀行システム v 1.0 に見つかったシンプルなCSRF PoC...
vertx-web-xsrf
Обзор Реализация CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl в Vert.x Web не создаёт уникальные для каждой пользовательской сессии токены CSRF. Вредоносный веб-сайт всё ещё может выполнить CSRF, получив действительный токен CSRF, добавив его в HTML-форму и отправив форму на...
halo-cors-csrf-CVE-2026-67921
CVE-2026-67921: Halo CMS CORS設定ミス + CSRF保護バイパス複合攻撃 概要 Halo CMS バージョン2.25.4以前には、2つのセキュリティ設定ミスにより深刻な複合攻撃の脆弱性が存在します: 1. CORS設定ミス : CORSポリシーが任意のオリジンをcredentials: trueとともに許可している 2. CSRF保護バイパス : すべてのAPIエンドポイント/api/、/apis/がCSRF保護から除外されている...
CVE-2026-18780
Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...
CVE-2025-70899
이 저장소는 PHPgurukul 온라인 과정 등록 시스템에서 CSRF 보호 누락 취약점을 입증하는 개념 증명PoC을 포함하고 있습니다. 📄 전체 PoC 보기: MissingCSRFprotectionpoc.md...
CVE-2026-81890
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...
CVE-2018-8718
Exploit 제목 : Jenkins mailer 플러그인 CSRF 취약점 - CSRF 메일 보내기 날짜 : 2018/06/05 Exploit 작성자 : Yeom Geun Cheol 공급업체 홈페이지 : https://jenkins.io/ 소프트웨어 링크 : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi 버전: 1.20 미만 1.1 1.20 테스트 환경: Linux , Windows CVE : CVE–2018-8718 CVE-2018-8718 POC + ...
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin GeoDirectory versions = 2.8.176...
CVE-2026-78280
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...
WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...
WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...