PT-2026-145190

Cross-Site Request Forgery CSRF vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75...

CVE-2026-118411: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an…

Cross-Site Request Forgery CSRF in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions...

CVE-2026-125848: webriti Leo: Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects…

Cross-Site Request Forgery CSRF vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4...

CVE-2026-124263: plainware Locatoraid Store Locator: Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site…

Cross-Site Request Forgery CSRF vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75...

CVE-2026-125445: Infomaniak Network VOD Infomaniak: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site…

Cross-Site Request Forgery CSRF vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16...

CVE-2026-125784: Magnigenie RestroPress: Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request…

Cross-Site Request Forgery CSRF vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11...

PT-2026-145020

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

PT-2026-145136

Cross-Site Request Forgery CSRF vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5...

PT-2026-145158

Cross-Site Request Forgery CSRF vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11...

CVE-2026-125838: webriti Quality: Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue…

Cross-Site Request Forgery CSRF vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3...

PT-2026-145308

A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters...

PT-2026-145223

Cross-Site Request Forgery CSRF vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2...

PT-2026-145232

Cross-Site Request Forgery CSRF vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1...

PT-2026-145174

Cross-Site Request Forgery CSRF in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a craft...

PT-2026-145224

Cross-Site Request Forgery CSRF vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4...

PT-2026-145651

This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site. The module doesn't sufficiently protect against cross-site request forgery CSRF on its admin routes. This...

CVE-2023-32315-POC

CVE-2023-32315-POC CVE-2023-32315-Openfire-Bypass-Py Overview This code is a Python version POC for CVE-2023-32315. It performs a series of operations to verify whether the target website is affected by the CVE-2023-32315 vulnerability and attempts to execute certain operations on the affected...

CVE-2026-109481

Cross-site request forgery csrf in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...

GHSA-GMJ8-HVJ3-49MW Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...