PT-2026-68390

Name of the Vulnerable Software and Affected Versions Google Authenticator WordPress plugin versions prior to 0.56 Description The plugin fails to verify a CSRF Cross-Site Request Forgery nonce—a unique token used to prevent unauthorized requests—when saving the two-factor authentication setup...

PT-2026-68583

Name of the Vulnerable Software and Affected Versions Theme My Login versions prior to 7.1.15 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...

CVE-2026-66681: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

PT-2026-68442

Name of the Vulnerable Software and Affected Versions Carbon console affected versions not specified Description The Ajax processor fails to protect state-changing operations from Cross-Site Request Forgery CSRF, a type of attack that tricks an authenticated user into executing unintended actions...

PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

CVE-2026-12605: Server-Side Request Forgery (SSRF)

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the controller JVM process. An attacker can execute arbitrary code by tricking a user with the necessary permissions into submitting a malicious request. Remediation Upgrade...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

EUVD-2026-53311

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-71238

The CVE-2026-71238 entry affects DjangoCRM where a hardcoded Django SECRET_KEY is stored in webcrm/settings.py instead of reading from the environment. This secret key is used for session signing, CSRF token generation, and password reset tokens, allowing anyone with access to the public reposito...

CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-11920

CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-53289

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

EUVD-2026-53196

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

CVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...