CVE-2019-16659

TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...

CVE-2019-14703

A CSRF issue was discovered in webparam?user=set=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account...

CVE-2019-15828

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...

CVE-2018-20188

FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account...

CVE-2019-10888

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html...

CVE-2019-10644

An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account...

CVE-2018-5073

Online Ticket Booking has CSRF via admin/movieedit.php...

CVE-2019-16311

NIUSHOP V1.11 has CSRF via searchinfo to index.php...

CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

CVE-2019-14346

Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password...

CVE-2019-15660

The wp-members plugin before 3.2.8 for WordPress has CSRF...

CVE-2019-15496

MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...

CVE-2019-15113

The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF...

CVE-2019-13056

An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection...

CVE-2019-13974

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings...

CVE-2019-15128

iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user...

CVE-2019-13395

The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory settings, or even upload an entire malicious configuration file...

CVE-2019-14933

Bagisto 0.1.5 allows CSRF under /admin URIs...

CVE-2019-10673

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...