69244 matches found
CVE-2026-66669 WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4...
WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Superb Addons: Blocks, Patterns & Theme Designer versions = 4.2.4...
CVE-2026-122675 WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3...
EUVD-2026-119005
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3...
CVE-2026-122675
The Wpmet Wp Social (wp-social) WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2026-122675 . This issue affects versions up to and including 3.2.3 . The vulnerability allows an attacker to perform unauthorized actions on behalf of a user. No...
WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Mor Golan in WordPress Plugin Wp Social versions = 3.2.3...
CVE-2026-122001
The Komfortkasse for WooCommerce WordPress plugin, in versions before 1.4.9 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The plugin fails to properly validate the authenticity of REST API requests , overriding the standard WordPress nonce verification . This security bypass allows...
CVE-2026-122001 Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrat...
CVE-2026-117588 WP Google Review Slider < 18.11 - Google API Settings Update via CSRF
The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted...
CVE-2026-117588
The WP Google Review Slider WordPress plugin (versions before 18.11 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of nonce validation when updating the active Google Places configuration . An attacker who can trick a site administrator into clicking a crafted link ca...
CVE-2026-17369
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's o...
CVE-2026-17312
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link th...
EUVD-2026-118752
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's o...
CVE-2026-17369 Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's o...
CVE-2026-17312 Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link th...
EUVD-2026-118703
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link th...
CVE-2021-45007
CVE-2021-45007 Cross-Site Request Forgery Affected product and version: Plesk Obsidian 18.0.37 Severity: High Impact: Submit requests with attacker information Description: CSRF could let the attacker to submit new requests because there isn’t any CSRFtoken protection sent with requests to server...
lazyCSRF
LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...
CVE-2026-62856
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...
CVE-2026-62856 FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...