67818 matches found
CVE-2026-66474: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...
CVE-2026-14856: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...
CVE-2026-66428: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...
PT-2026-64876
A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the wap/authorize.ftl consent template in the OAuth2/OIDC consent page. An attacker can execute arbitrary JavaScript in the OpenAM origin by sending a victim with an active session a crafted display=wap...
NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. !NOTE This only affects your application if you are using the unstable RSC APIs...
GHSA-QWWW-VCR4-C8H2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. !NOTE This only affects your application if you are using the unstable RSC APIs...
Class06-Security-Vulnerability-Demo
Class04: Fixing Cross-Origin Vulnerabilities and Business Logi...
PT-2026-67617
Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...
CVE-2026-65540
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
CVE-2026-65536
Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...
CVE-2026-61981
Unauthenticated Cross Site Request Forgery CSRF in Simple Link Directory Pro = 15.0.8 versions...
CVE-2026-57626 WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...
CVE-2026-65539
Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...
CVE-2026-65536
CVE-2026-65536 affects the WordPress WooCommerce shipping plugin (Persian: افزونه حمل و نقل ووکامرس) for fast/custom delivery and courier options,
CVE-2026-65536
Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...
