CVE-2026-61671

The WeGIA web manager for charitable institutions is vulnerable to systemic IDOR and missing CSRF protection in versions prior to 3.8.7 . The /controle/control.php endpoint uses extract($_REQUEST) to process parameters like nomeClasse and metodo, allowing authenticated users to bypass ownership c...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-27062

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...

CVE-2026-27062

The WordPress WPFunnels plugin (versions $\le$ 3.13.5 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions by tricking a victim into clicking a malicious link or visiting a compromised webpage while authenticated to the...

CVE-2026-27062 WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...

CVE-2026-27062 WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...

EUVD-2026-112884

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin WPFunnels versions = 3.13.5...

CVE-2026-116399

Cross-Site Request Forgery CSRF vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2...

CVE-2026-116399

The InstaWP Connect WordPress plugin (versions

CVE-2026-116399 WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2...

EUVD-2026-112912

Cross-Site Request Forgery CSRF vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2...

WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mroccon in WordPress Plugin InstaWP Connect versions = 0.1.4.2...

CVE-2026-5702

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-5702

The SABBATIC application is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to trick an authenticated user into interacting with a malicious link or page, which then sends unauthorized requests to a vulnerable endpoint. No specific technical r...

EUVD-2026-112743

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...