CVE-2020-23582

CVE-2020-23582 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" A vulnerability in the "/admin/wlmultipleap.asp" of "optilink OP-XT71000N version: V2.2" Software could allow an unauthenticated, remote attacker to conduct a cross-site...

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred THIS \space EXPLOIT \space MAY \space VIOLATE \space THE \space LAW.$$ $$\colorred\space YOU \space ARE \space RESPONSIBLE \space FOR \space YOUR \space ACTIONS.$$ $$\colorredDEMONSTRATION \space PURPOSE \space ONLY.$$ DESCRIPTION RCE by Non-Admin Users via CSRF in...

EUVD-2026-124278

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and...

CVE-2026-122003

The Abilities Bridge WordPress plugin (versions prior to 1.4.2 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists because the plugin fails to require a valid nonce when re-authenticating a REST API request from a logged-in session cookie. An attacker can trick a logged...

CVE-2026-122003 Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and...

CVE-2025-25062

CVE-2025-25062 Description Usage Example Timeline Description A Stored Cross-Site-Scripting XSS vulnerability exists in the Backdrop CMS 1.29.2 post edit page. This script chains the vulnerability with a CSRF payload to achieve privilege escalation from the role of 'Editor' to 'Administrator'...

CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management system built using PHP and MySQL. Auditor Shoaib Alam - LinkedIn Profile Description CSRF Vulnerability in Profile Update Section A Cross-Site Request Forgery CSRF vulnerability has been identified in the Gym Management System. This issue is...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 Exploit Title: Vehicle Service Management System - 'Multiple' Cross-Site Request Forgery CSRF Leads to Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM References:...

CVE-2019-9202

CVE-2019-9202 Nagios IM 2.6 remote code execution exploit: CSRF + SQLi + RCE + LPE -- remote root Description By chaining a Cross-Site Request Forgery CSRF / authorization bypass CVE-2019-9203 it is possible to exploit a Union-based SQL injection CVE-2019-9204, a Remote Code Execution RCE...

CVE-2020-13259

CVE-2020-13259 PoC of Full Account Takeover on RAD SecFlow-1v A vulnerability in the web-based management interface of RAD SecFlow-1v could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient...

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS Exploit Author: emirhanerdogu Vendor Homepage https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html Software Link...

sudowp-clickfunnels-zurich

SudoWP Zurich for ClickFunnels Contributors: SudoWP, WP Republic Original Authors: Etison, LLC Tags: clickfunnels, security-patch, legacy, landing pages, funnels, sudowp Requires at least: 4.3 Tested up to: 6.7 Stable tag: 0.1.1 License: GPLv2 or later Security Notice This is a community-maintain...

Simplog-Exploit

Simplog-Exploit This repository contains the setup, exploit and patch for CVE-2009-4092 Simplog CSRF Vulnerability. The vulnerabily exists in the user.php file of Simplog 0.9.3.2, a web application used for providing people with an easy way to create and maintain a blog on their personal websites...

Scanner-and-Patcher

Scanner and Patcher Overview: The Scanner and Patcher project is built as part of the AlphaSecure framework, which has been presented and published at ACM IC3 2024 under the title AlphaSecure: A State-of-the-Art Framework for Web Application Vulnerabilities Detection and Patch Recommendation Usin...

CVE-2025-1306

Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...

CVE-2018-8062

CVE-2018-8062 Persistent XSS on Comtrend AR-5387un router Exploitation explanation: To exploit this vulnerability, once logged into the router, a WAN service must be created Click on "Advanced Setup", "WAN Service". "Add button", "Next" Then insert the payload into the "Enter Service Description"...

CVE-2025-68434-OSPOS-CSRF

CVE-2025-68434: CSRF Unauthorized Administrator Creation in OpenSourcePOS Metadata| Details ---|--- CVE ID| CVE-2025-68434 Severity| Critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability Type| Cross-Site Request Forgery CWE-352 Affected Versions| OpenSourcePOS v3.4.0, v3.4.1...

CVE-2022-1421

CVE-2022-1421 A Proof-Of-Concept for CVE-2022-1421 Discy References https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249 https://vulners.com/cve/CVE-2022-1421...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Overview PoC of CVE-2019-9787 CSRF WordPress Version 5.0 refference Do not use this except for test purpose. Installation $ docker-compose up -d 1. access http://localhost:8080/ and install WordPress. you only have to create WP admin account. 2. access...