PT-2026-6561

Name of the Vulnerable Software and Affected Versions Axigen Mail Server versions prior to 10.5.57 Axigen Mail Server versions 10.6.0 through 10.6.25 Description The software contains a Cross-Site Request Forgery CSRF issue in the WebAdmin interface. This is due to improper handling of the s...

CVE-2024-40685

CVE-2024-40685 affects IBM Operations Analytics – Log Analysis and IBM SmartCloud Analytics – Log Analysis. Connected sources confirm a CSRF vulnerability that could allow an attacker to trick a trusted user into performing unauthorized actions. Affected versions include IBM Operations Analytics ...

CVE-2026-25015

Cross-Site Request Forgery CSRF vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through = 1.2.53...

📄 Monstra CMS 3.0.4 Shell Upload

Monstra CMS version 3.0.4 proof of concept remote shell upload exploit. ============================================================================================================================================= | Title : Monstra CMS 3.0.4 shell upload Vulnerability | | Author : indoushka | |...

CVE-2026-24007

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items creating artifact links from the release. This...

CVE-2026-25151 Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued...

CVE-2026-25151 Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued...

CVE-2026-25155 [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0...

CVE-2026-25155 [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0...

CVE-2026-25155 [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0...

Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Summary Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. Impact A vulnerability in checkCSRF lets an attacke...

GHSA-R666-8GJF-4V5F Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Summary Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. Impact A vulnerability in checkCSRF lets an attacke...

CVE-2026-25014

Cross-Site Request Forgery CSRF vulnerability in themelooks Enter Addons enteraddons allows Cross Site Request Forgery.This issue affects Enter Addons: from n/a through = 2.3.2...

CVE-2026-24986 WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forgery.This issue affects Simple Membership WP user Import: from n/a through = 1.9.1...

CVE-2026-20704

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed...

PT-2026-6227

Name of the Vulnerable Software and Affected Versions Brainstorm Force Sigmize versions n/a through 0.0.9 Description A Cross-Site Request Forgery CSRF issue exists in Brainstorm Force Sigmize sigmize, allowing attackers to perform actions on behalf of authenticated users. This occurs because the...

PT-2026-5852

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially...

EndRun Technologies Sonoma Cross-Site Request Forgery (CVE-2025-60956)

Cross Site Request Forgery CSRF vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. This plugin only works with...

PT-2026-6234

Name of the Vulnerable Software and Affected Versions Simple Membership WP user Import versions through 1.9.1 Description The Simple Membership WP user Import software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to potentially perform actions on behalf of...

CVE-2026-25221

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...