69228 matches found
CVE-2026-11784-Optimole-CSRF
CVE-2026-11784: CSRF to Arbitrary File Overwrite in Optimole WordPress Plugin Summary A Cross-Site Request Forgery CSRF vulnerability in the Optimole plugin for WordPress versions = 4.2.5 allows unauthenticated attackers to silently overwrite existing media library assets via the...
CVE-2026-126775
The Social-auth-core library (versions 4.7.0 before 7.0.0) contains a login cross-site request forgery (CSRF) vulnerability in its SAML backend . The root cause is that the backend restores sessions specified in the unsigned RelayState parameter . An attacker can exploit this by delivering a vali...
CVE-2026-126775 Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form,...
CVE-2026-126775 Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form,...
nepstech-xpon-router-CVE-2024-40119
nepstech-xpon-router-CVE-2024-40119 Author: Subhodeep Baroi CVE-2024-40119: CSRF Vulnerability in Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 Description CVE-2024-40119 is a Cross-Site Request Forgery CSRF vulnerability in the Nepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 firmware v2.0.1. This...
CVE-2026-49049
CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler — Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...
CVE-2020-36730
CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...
DRUPAL-CONTRIB-2026-330
This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions. The Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery CSRF. An attacker could trick a user with...
DRUPAL-CONTRIB-2026-326
This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site. The module doesn't sufficiently protect against cross-site request forgery CSRF on its admin routes. This...
html-poc
Proof of concept code for client-side vulnerabilities Basic HTML proof of concepts for issues such as: Clickjacking insecure CORS settings CSRF Tabnapping XSSI postMessage issues Most of these are pretty basic, but having them all in one place avoids writing the same things over and over again. T...
CVE-2019-1759-csrf-js-rce
CVE-2019-1759 Bolt-cms 3.6.10 Csrf - xss - rce Watch the video...
EUVD-2026-123619
A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters...
CVE-2026-77168
Revive Adserver version 6.0.8 and earlier is susceptible to a cross-site request forgery (CSRF) vulnerability in the tracker-invocation.php component. The root cause is a leftover state-changing handler that accepts request parameters without verifying a CSRF token , despite not being part of the...
CVE-2020-24033
The latest version of fs.com S3900 24T4S 1.7.1 and all previous version, CSRF backstage admin The form does not have a authentication or token authentication mechanism, so there is a Cross-Site Request Forgery Add user account to add an user with full access. All form on the S3900 24T4S are subje...
CVE-2026-56291
CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension CISA KEV: Added July 10, 2026 — acti...
CVE-2025-25965
CVE-2025-25965: Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.2 Introduction Cross-Site Request Forgery CSRF remains one of the most overlooked yet dangerous vulnerabilities affecting web applications today. CVE-2025-25965 is a newly discovered CSRF vulnerability in the...
CVE-2026-125848
Cross-Site Request Forgery CSRF vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4...
CVE-2026-125849
Cross-Site Request Forgery CSRF vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3...