webpack-dev-server CVE-2026-14620 open-editor CSRF detect

Detects CVE-2026-14620 in webpack-dev-server = 5.2.5: cross-site GET /webpack-dev-server/open-editor?fileName= reaches launchEditor. Probes cors and no-cors Sec-Fetch combinations; vulnerable when cors cross-site returns HTTP 200 while no-cors cross-site is blocked 403. !/usr/bin/env python3 --...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

CSRF to Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.62...

CVE-2026-75151 SourceCodester Onlne Examination & Learning Management System cross-site request forgery

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-75151

SourceCodester Online Examination & Learning Management System 1.0 has a CSRF vulnerability in an unspecified function. No patch version or workaround is provided. No in-the-wild exploitation details are available. CVSS 3.1 base score 4.3 (MEDIUM), network vector, user interaction required. No af...

CVE-2026-66602: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

CVE-2026-45119: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

PT-2026-77242

Name of the Vulnerable Software and Affected Versions Halo CMS versions prior to 2.25.5 Description A Cross-Site Request Forgery CSRF issue exists within the CorsConfigurer.java and CsrfConfigurer.java components. This flaw allows a remote attacker to execute arbitrary code. CSRF is a type of...

EUVD-2026-61145

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2026-66635: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63...

PT-2026-78248

Name of the Vulnerable Software and Affected Versions HashBar – WordPress Notification Bar versions prior to 2.0.1 Description Cross-Site Request Forgery CSRF in DevItems HashBar – WordPress Notification Bar allows an attacker to induce a user to perform actions they did not intend to do. CSRF is...

CVE-2026-75151: Cross-Site Request Forgery (CSRF)

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-45129: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77150

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45127: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

PT-2026-77180

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

PT-2026-80335

Summary The Froxlor AJAX endpoint lib/ajax.php is missing Cross-Site Request Forgery CSRF protection. While the main application lib/init.php enforces CSRF token validation on all state-changing HTTP requests POST/PUT/PATCH/DELETE, the standalone lib/ajax.php endpoint bypasses this mechanism...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77063

Name of the Vulnerable Software and Affected Versions Slider by 10Web versions prior to 1.2.63 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to force an authenticated user to execute unwanted actions on the web application. Recommendations...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...