CVE-2025-70517

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request...

verify-ghsa-c4j6-fc7j-m34r

التحقق من GHSA-c4j6-fc7j-m34r أداة تحقق داخل النطاق in-band verifier لـ GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — تزوير الطلبات من جانب الخادم SSRF في Next.js عبر طلبات ترقية WebSocket. ⚠️ للاستخدام المصرح به في الاختبارات الأمنية فقط. أنت وحدك المسؤول عن التأكد من أن لديك الإذن لاختبار كل هدف تمرره...

CVE-2025-57310

CVE-2025-57310 ثغرة تزوير الطلبات عبر المواقع CSRF في Salmen2/Simple-Faucet-Script الإصدار 1.07 عبر طلب POST مصمم إلى admin.php?p=ads&c=1 تتيح للمهاجمين تنفيذ تعليمات برمجية عشوائية. CWE CWE-352: تزوير الطلبات عبر المواقع CSRF CVSS v3.1 النتيجة الأساسية: 8.8 عالية...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

vRealize Operations Manager API - Server-Side Request Forgery

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. id: CVE-2021-21975 info: name: vRealize Operation...

NextChat_SSRF_CVE-2023-49785

NextChatSSRFCVE-2023-49785...

Linux Distros Unpatched Vulnerability : CVE-2026-106216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypas...

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

CVE-2025-70522

The Fanvil x7a firmware version 2.6.0.1182 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The issue stems from the request handler failing to enforce cross-origin resource protection for state-changing requests. This allows an attacker to bypass cross-origin boundaries and perform un...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Andro...

CVE-2025-70517

The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross-origin resource protection for state-changing requests. This lack of protection allows for a complete bypass of the cross-origin boundary, enabling Cross-Site Request Forgery (CSRF) attacks against any applicatio...

CVE-2026-106032

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

DEBIAN-CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93735

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...