69244 matches found
CVE-2026-65566
The Meow Apps AI Engine WordPress plugin (versions
CVE-2026-65566 WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8...
WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by AndrewN in WordPress Plugin AI Engine versions = 3.8.8...
CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...
CVE-2026-45141
Chamilo LMS, an open-source learning management system, is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 2.0.1 . The vulnerability exists because the add, delete_gradebook_from_skill, save_profile, and delete_profile actions within public/main/inc/ajax/skill.ajax.php perfor...
CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...
CVE-2026-45141
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the "add", "deletegradebookfromskill", "saveprofile", and "deleteprofile" actions in "public/main/inc/ajax/skill.ajax.php" perform database mutations without "Security::checktoken" validation. An attacker can use cross-site...
CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...
CVE-2026-119426
A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery CSRF token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL comman...
CVE-2026-112374 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...
CVE-2026-112374
FOSSBilling versions prior to 0.8.9 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the staff guest login endpoint (POST /api/guest/staff/login ). The root cause is that the checkGuestClientAuthentication() function only allowlists client_login and client_create, failing to provide ...
CVE-2026-112374 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...
CVE-2026-112374 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...
CVE-2026-119426
Versions of phpMyAdmin through 5.2.3 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is a CSRF token bypass occurring on non-AJAX POST requests sent to the /sql or /database/sql endpoints. A remote attacker can lure an authenticated victim into submitting a cro...
CVE-2026-119426 phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...
CVE-2026-119426 phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...
CVE-2026-119426 phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...
CVE-2026-118570
Cross-Site Request Forgery CSRF vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1...