CVE-2026-82544

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

ConceptronicIPCam_MultipleVulnerabilities

Multiple vulnerabilities at Conceptronic IP Cameras with 0.61.X. web firmware. A CSRF and Denial of Service vulnerabilities have been found at Conceptronic IP Cameras. CVE| Description ---|--- CVE-2018-6407| Unauthenticated remote Denial of Service vulnerability CVE-2018-6408| CSRF allows to chan...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploiting a Cross-site request forgery CSRF attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version...

CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc root@kitploit: history.pushState'', '', '/' Success:...

roller-csrf

أباتشي رولر v6.1.2 - تزوير الطلب عبر الموقع CSRF في تحديث الملف الشخصي تفاصيل الثغرة الإصدار : v6.1.2 التاريخ : 2025-11-09 مؤلف الاستغلال : Van Lam Nguyen فيسبوك : https://www.facebook.com/vanlam1412 الصفحة الرئيسية للمورد : https://roller.apache.org رابط البرنامج :...

MAGMI - Cross-Site Request Forgery

MAGMI Magento Mass Importer is vulnerable to cross-site request forgery CSRF due to a lack of CSRF tokens. Remote code execution via phpcli command is also possible in the event that CSRF is leveraged against an existing admin session. id: CVE-2020-5776 info: name: MAGMI - Cross-Site Request...

CVE-2021-32159

..| CSRFtoCommandInjection1 |.. Descrição : Explorando um ataque de falsificação de solicitação entre sites CSRF para obter uma Injeção de Comando através da funcionalidade de Upload e Download do Webmin Versão Testada : Webmin 1.973 versão mais recente do GitHub 07/03/2021 Tipo de Ataque: Remoto...

CVE-2021-46080

CVE-2021-46080 Exploit-Titel: Vehicle Service Management System – „Mehrere“ Cross-Site-Request-Forgery CSRF führen zu Stored Cross-Site-Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM Referenzen:...

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

CVE-2024-57373

Vulnerabilità CSRF in LifestyleStore v1.0 📌 Panoramica Questo repository documenta una vulnerabilità di Cross-Site Request Forgery CSRF identificata nel progetto LifestyleStore v1.0. Il difetto consente agli attaccanti di eseguire azioni non autorizzate per conto di utenti autenticati, comportand...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-13156

CVE-2026-13156 — Integrazione SMTP Ufficiale MailerSend !IMPORTANT Abstract: È stata scoperta una vulnerabilità di Cross-Site Request Forgery CSRF ad alta severità CVE-2026-13156 nel plugin ufficiale MailerSend SMTP Integration per WordPress 1.0.8. L'handler di cancellazione della configurazione...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF a RCE nel plugin WordPress Custom CSS, JS & PHP = 2.4.1 🧠 Descrizione Una vulnerabilità Cross-Site Request Forgery CSRF nel plugin WPFactory Custom CSS, JS & PHP consente Remote Code Execution RCE tramite l'iniezione di codice PHP malevolo via richieste POST non autorizzat...

CVE-2025-31033

⚠️ CVE-2025-31033 - CSRF im WordPress Buddypress Humanity Plugin = 1.2 🛡️ Zusammenfassung der Schwachstelle Das Buddypress Humanity Plugin für WordPress Version = 1.2 ist anfällig für Cross-Site Request Forgery CSRF. Diese Schwachstelle ermöglicht es einem Angreifer, einen Benutzer mit höheren...

CVE-2024-52402

🚀 Exploit per CVE-2024-52402: Plugin WordPress Exclusive Content Password Protect -un -p...

CVE-2025-10377

Prova di concetto CVE-2025-10377 Cross-Site Request Forgery CSRF nel Plugin System Dashboard Funzione sdtogglelogs Tipo di vulnerabilità: Cross-Site Request Forgery CSRF Funzione interessata: sdtogglelogs CVSS v3.1: 4.3 Medio Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Nota: il punteggio riflette...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 Vulnerabilità CSRF: Porta alla Creazione di Client Fittizi Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/ Vulnerability Name : Cross-Site Request ForgeryCSRF Affected Version : V1.2 Introduzione Una vulnerabilità di Cross-Site Request...

CVE-2023-43147

CVE-2023-43147 Fornitore: PHPJabbers Homepage del fornitore: https://www.phpjabbers.com/ Link del software: https://www.phpjabbers.com/limo-booking-software Versione: 1.0 Testato su: Windows 10 Pro Impatto: Aggiunta di un utente attaccante con privilegi di amministratore CVE: La vulnerabilità Cro...