CVE-2025-14340

XSS 导致管理员账户接管（CVE-2025-14340） Payara 的管理 REST 接口（Administration Rest Interface）中存在一个跨站脚本（XSS）漏洞，允许执行攻击者控制的 JavaScript，从而导致管理员账户被接管。原因如下： 1. 该面板使用 HTTP Basic Auth（对于同源请求，浏览器会自动发送凭据）。 2. change-admin-password 端点更新用户密码时不需要当前密码。 3. change-admin-password 表单没有 CSRF 保护。 4. 通过 /management/domain/version ...

zappzarapp-php-security

⚡ zappzarapp/security 全面的 PHP 安全库，提供 CSP、安全响应头、CSRF 防护、安全 Cookie、密码验证、输入净化、速率限制、SRI、密钥加载、加密、会话安全、TOTP 双因素认证、签名 URL 和安全事件日志记录。 亮点 一体化 — 单个可组合包中包含 17 个安全模块 默认安全 — 严格的 CSP，无 unsafe-，HTTPS 优先 框架无关 — 适用于任何 PHP 8.4+ 应用程序 不可变且类型安全 — readonly 类、枚举、with API 质量保障 — PHPStan Level 8、Psalm Level 1、100% Mutati...

CVE-2023-33409

CVE-2023-33409 Minical 1.0.0 is vulnerable to Cross-Site Request Forgery. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC The application does not have any CSRF protection, hence a specially crafted HTTP request can be used to, Add New User Delete Existin...

Rocky Linux 8 [CIQ] Security Update: custodia / ipa-healthcheck / ipa-healthcheck-core / opendnssec / etc Multiple Vulnerabilities (crlsa-2024_0143)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20240143 advisory. Kerberos: delegation constrain bypass in S4U2Proxy CVE-2020-17049 ipa: Invalid CSRF protection CVE-2023-5455 Tenable has extracted the preceding descriptio...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

CVE-2026-85274

Prior to version 1.7.2 , InvoicePlane is vulnerable to a Cross-Site Request Forgery (CSRF) flaw because the Recurring::stop() function is exposed as a state-changing GET route without CSRF token validation. An attacker can trick an authenticated administrator into loading malicious content that t...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-90882: Permissive Cross-domain Policy with Untrusted Domains

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

PT-2026-95103

Name of the Vulnerable Software and Affected Versions Speakr versions prior to 0.8.21-alpha Description An issue exists where the csrf exempt for api tokens before request hook in src/app.py calls csrf.exemptview func, which permanently adds the selected view to the process-global exemption set o...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

EUVD-2026-70487

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-73780 Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

EUVD-2026-67808

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...