67656 matches found
Cross-site Request Forgery (CSRF)
Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...
EUVD-2026-68772
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections...
CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 lacks CSRF protection on its settings page. An attacker can craft a request that, when submitted by a logged-in administrator , silently replaces the configured MailChimp API key. Once swapped, all subsequent member registr...
EUVD-2026-70043
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-84759
Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...
CVE-2026-84764
Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...
CVE-2026-84770
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
CVE-2026-66652
Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...
CVE-2026-66652
CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...
CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...
CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...
EUVD-2026-69943
Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...
WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Tour versions = 5.5.1...
CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
CVE-2026-84770
CVE-2026-84770 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the Mang Board WP WordPress plugin, affecting versions ≤ 2.3.8 . The vulnerability was discovered by John Ryan Albon and is rated CVSS 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning a ...
CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...
CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...
CVE-2026-84764
CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...