CVE-2026-121451 AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

Cybersecurity-CTF-Labs-Collection-Web-Application-Security-Exploit-Analysis

Cybersecurity-CTF-Labs-Collection-Web-Application-Security-Exp...

CLEANSTART-2026-QJ55505 Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain

Security vulnerability affects the apache-superset package. Selenium Server Grid before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain...

CVE-2026-63433: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121551: postfixadmin: PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users…

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...

PT-2026-136711

Name of the Vulnerable Software and Affected Versions SourceHut meta.sr.ht versions 0.56.11 through 0.88.9 Description An authorization bypass allows unauthenticated attackers to register accounts even when public registration is disabled. The issue occurs because the registration path incorrectl...

CVE-2026-97718

A cross-site request forgery (CSRF) vulnerability exists in version 14.60 of the Secure Access server . Due to a bypassed security control , a remote attacker can trick an administrator into creating a new account under the attacker's control. No specific remediation steps or exploit links are pr...

CVE-2026-97718 CSRF in Secure Access Server v14.60

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control...

websec-calizo-calizo

Web and Cloud Security - CS 595 This repository contains my w...

CVE-2026-103420

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

CVE-2026-103420

The StageIt Joomla extension by php-web-design.com is vulnerable to Cross-Site Request Forgery (CSRF) in versions 1.0-5.7.5 and 6.0-6.3.5 . This vulnerability allows an attacker to perform various actions on behalf of a user. The documents do not provide specific details regarding the root cause,...

CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

EUVD-2026-115179

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

CVE-2026-103420: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

PT-2026-135434

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...

PT-2026-135545

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note create endpoint stores the note parameter without sanitization in the support ticket note table, and src/modules/Support/templates/admin/mod support tickets.html.twig renders each...

PT-2026-135813

Name of the Vulnerable Software and Affected Versions Secure Access server version 14.60 Description A cross-site request forgery CSRF issue exists due to a bypassed security control. This allows an attacker to trick an administrator into creating an account under the attacker's control...

CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...