11 matches found
CVE-2026-40857
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-40857 CSRF token bypass in T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
EUVD-2026-80672
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-40857 CSRF token bypass in T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-40857
WNC T-Mobile 5G Box IDU routers contain a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on...
CVE-2026-40857: Cross-Site Request Forgery (CSRF)
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2018-12990
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...
Code injection
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...
CVE-2018-12990
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...
CVE-2018-12990
CVE-2018-12990 affects phpwcms 1.8.9. A remote attacker can disclose the installation path via an invalid csrf_token_value field, an information-disclosure issue arising from the csrf_token handling. Several sources (NVD/CNVD entries and related databases) describe phpwcms 1.8.9 as vulnerable to ...
CVE-2018-12990: Exposure of Sensitive Information to an Unauthorized Actor
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...