CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104451 YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

EUVD-2026-91459

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

EUVD-2026-91458

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104447

Versions of YesWiki before 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the autoupdate UpdateAction . The root cause is the use of unprotected GET requests , which allows an attacker to delete installed packages. By luring a logged-in administrator to a crafted...

CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-96567

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

EUVD-2026-91239

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postid' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2023-37598

CVE-2023-37598 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF Overview CVE ID: CVE-2023-37598 Vulnerability Type: Cross-Site Request Forgery CSRF Affected Product: issabel-pbx v4.0.0-6 Severity: Medium Discovered by: Sahil Ojha Disclosure Date: 10/07/2023 Vendor Homepage:...

CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete User Group Disclaimer: This repository is intended for educational and authorized security research purposes only. Do not use this exploit against any system you do not own or have explicit written permission to test...

rosettaflash

Rosetta Flash CVE-2014-4671 Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SW...

explo

explo explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and...

ExtendedMacro

ExtendedMacro ExtendedMacro is plug-in for BurpSuite proxy. It provides similar but extended functionality of BurpSuite Macro feature. The main functionality is, that you are able to trigger one or more request before every request triggered from Intruder, Repeater, Scanner, Sequencer or Spider...

lazyCSRF

LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...

CSRF-exploit-generator

CSRF-exploit-generator The CSRF Exploit Generator allows users to generate a CSRF exploit form with configurable parameters. CSRF-exploit-generator Features Input Target URL : Specifies the URL to be exploited. Input POST Parameters : Allows adding POST parameters to be sent via the CSRF request...