CVE-2026-86135 Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-86135

WatchGuard Dimension is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its database snapshot creation feature. A remote attacker can trick an authenticated administrator into visiting a specially crafted web page, triggering unauthorized snapshot creation that leads to Denial of...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

EUVD-2026-72579

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76959 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

CVE-2026-86307

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit...

CVE-2026-86281 SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public...

CVE-2021-46080

CVE-2021-46080 漏洞利用标题：Vehicle Service Management System - 多个跨站请求伪造（CSRF）导致存储型跨站脚本（XSS） 漏洞利用作者：SANU P.L CVE：CVE-2021-46080 CVSS：4.8 中危 参考链接： https://www.plsanu.com/vehicle-service-management-system-multiple-cross-site-request-forgery-csrf-leads-to-stored-cross-site-scripting-xss...

CVE-2023-43147

CVE-2023-43147 厂商：PHPJabbers 厂商主页：https://www.phpjabbers.com/ 软件链接：https://www.phpjabbers.com/limo-booking-software 版本：1.0 测试环境：Windows 10 Pro 影响：添加具有管理员权限的攻击者用户 CVE： limo-booking-software 中的跨站请求伪造漏洞允许远程攻击者执行添加用户操作并赋予管理员权限 POC 1 - 创建包含以下代码的文件并保存为 HTML。如果要保存新的请求以制造 CSRF，请确保将 roleid=0 改为 1 roleid=1...

CVE-2023-40868

CVE-2023-40868 mooSocial MooSocial Software v.Demo 中存在跨站请求伪造漏洞，远程攻击者可利用该漏洞通过“删除账户”和“停用账户”功能执行任意代码。 该漏洞是 mooSocial MooSocial Software v.Demo 应用程序中的一个跨站请求伪造（CSRF）漏洞。CSRF 漏洞是指恶意攻击者可以诱骗受害者执行其本无意执行的操作。在这种情况下，攻击者可以诱骗受害者点击包含恶意代码的链接或打开包含恶意代码的文件。该代码随后可用于删除或停用受害者的账户。 POC 1 - 创建一个包含以下代码的文件，并保存为 HTML 文件...

CVE-2024-52402

🚀 CVE-2024-52402 漏洞利用：WordPress Exclusive Content Password Protect 插件 -un -p 🛠️ 选项 root@kitploit: usage: CVE-2024-52402.py -h -u URL -un USERNAME -p PASSWORD Exploit for ECVE-2024-52402 By | Nxploit, Khaled ALenazi options: -h, --help show this help message and exit -u, --url URL Target WordPress...

CVE-2020-29254

CVE-2020-29254 TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。 ========================== 跨站请求伪造 CSRF： TikiWiki 21.2 允许在未使用 CSRF 防护的情况下编辑模板。这可能导致未经验证的远程攻击者实施跨站请求伪造 CSRF 攻击，并在受影响系统上执行任意操作。该漏洞源于受影响系统的基于 Web 的管理界面缺乏足够的 CSRF 防护。攻击者可利用此漏洞诱使用户访问恶意构造的...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ 仅限教育用途和授权环境使用。 针对CVE-2022-47447漏洞的功能性PoC，该漏洞影响一个易受攻击的WordPress插件，允许对经过身份验证的用户发起跨站请求伪造（CSRF）攻击。 VULNERABLE URL: /wp-admin/admin.php?page=WPAdvancedSearchCallbackStyles...

CVE-2025-10377

CVE-2025-10377 概念验证：插件系统仪表盘中的跨站请求伪造（CSRF）（函数 sdtogglelogs） 漏洞类型： 跨站请求伪造（CSRF） 受影响函数： sdtogglelogs CVSS v3.1： 4.3（中危） 向量： AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N （注：评分反映的是需要管理员受害者与用户交互的未授权状态变更。） 漏洞描述： 函数 sdtogglelogs 处理敏感操作，例如启用/禁用页面访问日志、错误日志和邮件投递日志。然而，它仅依赖于 $REQUEST'logtype' 参数和权限检查 currentusercan...

CVE-2026-86182 diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High root@kitploit:...