CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-78610

WatchGuard Dimension 's Web UI contains a Cross-Site Request Forgery (CSRF) vulnerability in the administrator passphrase change endpoint. Because the action lacks CSRF protection, an attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can chang...

CVE-2023-32315-java7-

CVE-2023-32315 0x01 Die zurückgegebene JSESSIONID und csrftoken abrufen und ein Anforderungspaket zum Hinzufügen eines Benutzers erstellen JSESSIONID und csrftoken ersetzen img.png root@kitploit: cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02...

CVE-2026-75814

Ebyte NE2-D11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its web management interface. The device does not adequately verify the origin or authenticity of submitted requests, allowing an unauthenticated remote attacker to lure an authenticated administrator to a crafted p...

CVE-2026-75814 Ebyte NA111-M Cross-Site Request Forgery

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-16732

A flaw was found in fastify. When configured with a numeric trustProxy value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, a...

CVE-2026-81273

Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...

CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...

CVE-2026-81273

FluentBooking Pro (WordPress plugin, versions

CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...

CVE-2026-81271

An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affects the WordPress GeoDirectory plugin in versions 2.8.176 and earlier . The flaw was discovered by Brian Willows and carries a CVSS 3.1 score of 8.8 (HIGH) , with network attack vector, low complexity, no privileges required, ...

EUVD-2026-66949

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-81271 WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-81271 WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-76549

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...