PT-2026-143726

Cross-site request forgery csrf in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

PT-2026-141591

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

CVE-2018-15365

Reflected XSS in Deep Discovery Inspector 3.8 I've found a reflected XSS vulnerability in the management web interface of Deep Discovery Inspector 3.8 Service Pack 5 Build: 3.85.1165 Vulnerable script path is /php/detectiondetailfilter.php. This script is accessible only by an authenticated user,...

CVE-2019-25137-RCE

CVE-2019-25137-RCE CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered This exploit script is based on script by Alexandre ZANNI EDB-ID 49488. It is slightly altered, changed the flow to skip token extraction before login, performed the login first...

CVE-2021-46398

CVE-2021-46398 - Lalie ARNOUD, Gaspard ANDRIEU In this repository, you will find a proof of concept of the exploitation of the CVE-2021-46398 flaw through a docker compose, as well as an analysis of the impacts of this flaw on information systems. Exploit Title: FileBrowser 2.17.2 - Cross Site...

CVE-2026-119755 Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...

CVE-2026-119755 Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...

CVE-2026-119755

Tasmota versions through 16.0.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the HttpCheckPriviledgedAccess() function. The root cause is a failure in Referer-based CSRF protection validation, which can be bypassed by crafting a Referer header containing the device's hos...

CVE-2026-119755 Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...

CVE-2026-124624

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624

A weakness in PipraPay 3.0.0 allows for the exposure of hard-coded credentials via the hash_hmac function in the pp-content/pp-include/pp-adapter.php file, which is part of the pp-token anti-CSRF Handler component. The vulnerability can be triggered remotely through manipulation. While a public e...

EUVD-2026-120054

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624 PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624 PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624: n/a PipraPay: A weakness has been identified in PipraPay 3.0.0

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

PT-2026-140414

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

VulnCheck KEV: CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-8640

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-84229

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests...

CVE-2026-8640

The IBM Security Verify Directory Web Application is vulnerable to Cross-Site Request Forgery (CSRF) attacks because it fails to set the SameSite attribute on session cookies. This flaw allows an attacker to induce authenticated users' browsers to transmit unauthorized requests to the application...