CVE-2026-104407: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9...

PT-2026-104798

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

PT-2026-106011

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

PT-2026-106017

🚨 CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the...

CVE-2026-102776: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns lies in its susceptibility to cross-site request forgery attacks. This allows attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to the of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-104766

Name of the Vulnerable Software and Affected Versions PowerPress Podcasting versions prior to 11.17.10 Description Cross-Site Request Forgery CSRF allows an attacker to induce a user to perform actions they did not intend to do on the PowerPress Podcasting plugin. Recommendations Update PowerPres...

Debian dla-4823 : roundcube - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4823 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4823-1 [email protected]...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 Reference report: GHSA-pgpj-v85q-h5fm This repository contains a docker compose configuration that setups both a pyLoad server and an attacker server that just provides a csrf.html. To test yourself, just run docker composer up you need to have docker composer installed additionall...

CVE-2020-23588

CVE-2020-23588 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" allows an unauthenticated, remote attacker to conduct a cross-sit...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Create by TheAlchimist cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

cve-2020-23127-PoC

cve-2020-23127-PoC CVE-2020-23127: https://www.cvedetails.com/cve/CVE-2020-23127/ Introduction This is my first CVE proof of concept and analysis. It was done as part of my cyber-security course on my 2nd year of Master in Computer Sciences at Université de Franche-Comté. I looked specifically fo...

CVE-2023-43147

CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...

CVE-2023-40868

CVE-2023-40868 Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. The vulnerability is a Cross-Site Request Forgery CSRF vulnerability in the mooSocial MooSocial Softwa...

CVE-2024-52402

🚀 Exploit for CVE-2024-52402: WordPress Exclusive Content Password Protect Plugin -un -p 🛠️ Options usage: CVE-2024-52402.py -h -u URL -un USERNAME -p PASSWORD Exploit for ECVE-2024-52402 By | Nxploit, Khaled ALenazi options: -h, --help show this help message and exit -u, --url URL Target WordPres...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

CVE-2020-29254

CVE-2020-29254 TikiWiki 21.2 permite editar plantillas sin el uso de una protección CSRF. ========================== Falsificación de Petición entre Sitios CSRF: TikiWiki 21.2 permite editar plantillas sin el uso de una protección CSRF. Esto podría permitir que un atacante remoto no autenticado...

Prestashop-CVE-2024-34716

Script de Explotación para Ataque CSRF y Reverse Shell Este script automatiza un exploit de CSRF Falsificación de Petición en Sitios Cruzados para cargar un reverse shell PHP en el servidor web de un objetivo y ejecutarlo. El reverse shell se entrega como un archivo ZIP mediante un payload CSRF...

CVE-2026-64849-poc-lab

Security Lab — SSRF Exploitation in MLflow Webhooks CVE-2026-64849 · MLflow Restricted use: lab material, only for authorized networks and environments. See Legal notice. 1. Executive summary Attribute| Value ---|--- Vulnerability| CVE-2026-64849 — SSRF via Webhook Redirect Bypass Affected...

EUVD-2026-92107

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...