zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

CVE-2023-33409

CVE-2023-33409 Minical 1.0.0 es vulnerable a Cross-Site Request Forgery. Proveedor: https://github.com/minical/minical Aplicación de demostración: https://demo.minical.io/ PoC La aplicación no tiene ninguna protección CSRF, por lo que una solicitud HTTP especialmente diseñada puede usarse para,...

CVE-2025-14340

XSS to Admin account takeover CVE-2025-14340 A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account take over. Because of: 1. The panel uses HTTP Basic Auth credentials are sent automatically by t...

EUVD-2026-70487

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-73780 Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

EUVD-2026-67808

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

EUVD-2026-59926

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-67990

Technical details are not publicly available in the provided documents; monitor for updates.

EUVD-2026-57326

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

EUVD-2026-53289

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-11920

CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...

EUVD-2026-53196

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

CVE-2026-66884

The CVE-2026-66884 affects oidcc_plug (Oidcc.Plug.AuthorizationCallback.call/2) in Erlang Ecosystem Foundation. A callback with no Oidcc.Plug.Authorize session is processed with security checks disabled, causing nonce, state, PKCE, IP and user-agent checks to be skipped and permitting state-less ...