PT-2026-145308

A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters...

PT-2026-145158

Cross-Site Request Forgery CSRF vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11...

PT-2026-145136

Cross-Site Request Forgery CSRF vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5...

PT-2026-145651

This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site. The module doesn't sufficiently protect against cross-site request forgery CSRF on its admin routes. This...

PT-2026-145020

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

CVE-2023-32315-POC

CVE-2023-32315-POC CVE-2023-32315-Openfire-Bypass-Py Overview This code is a Python version POC for CVE-2023-32315. It performs a series of operations to verify whether the target website is affected by the CVE-2023-32315 vulnerability and attempts to execute certain operations on the affected...

CVE-2026-109481

Cross-site request forgery csrf in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...

GHSA-GMJ8-HVJ3-49MW Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7 Description A Cross Site Request Forgery CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of...

CVE-2021-41349

CVE-2021-41349 Exploit! Microsoft Exchange Server Spoofing Vulnerability Exploit! Step To Reproduce! 1. Make A HTTP Request Like This & Capture On Burp 2. Make A CSRF PoC Of That Request & Save The HTML Output Into A File 3. Open The Saved Output In A Browser & Boom Or Use The HTML File Given &...

EUVD-2026-122859

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067

The Action Pack framework is vulnerable to Cross-Site Request Forgery (CSRF) because session stores other than ActionDispatch::Session::CookieStore (such as CacheStore, MemCacheStore, and certain third-party stores) do not include a SameSite attribute on session cookies. This occurs because only ...

CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

CVE-2026-125340

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in ...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...

CVE-2024-51567

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python proof-of-concept PoC exploit script for CVE-2024-51567 , a critical command injection vulnerability affecting CyberPanel v2.3.6. This vulnerability, found in the upgrademysqlstatus endpoint, enables remote command execution RCE by bypassing...