CVE-2026-100749: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted...

PT-2026-99531

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description Cross-Site Request Forgery CSRF occurs during the image upload process due to the absence of a CSRF token check. This allows a third-party site to upload files to an event and overwrite existin...

CVE-2026-100873: Cross-Site Request Forgery (CSRF)

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100747: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

CVE-2026-100748: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

PT-2026-99692

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote attack can be launched to trigger cross-site request forgery CSRF, a flaw where an attacker tricks a victim into performing actions they di...

PT-2026-99532

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description Cross-Site Request Forgery CSRF exists in various cart actions within the extension. CSRF is a type of attack that tricks a victim into submitting a malicious request. It occurs when an...

SUSE CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-100712

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

Cross-site Request Forgery (CSRF)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the 2fa management process. An attacker can disable two-factor authentication for a logged-in user by enticing them to follow a crafted link,...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100712

The froxlor software (versions through 2.3.10 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack that disables a user's two-factor authentication (2FA) . The root cause is that the 2FA management page (e.g., /customer_index.php?page=2fa&action=delete) responds to unauthenticated-trigge...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery CSRF vulnerability, which has yet to ...

WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability

CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the admin.extensions.php process. An attacker can cause unauthorized installation, update, pause, or unpause of extensions by tricking an authenticated administrator into visiting a crafted malicious...