Lucene search
+L

771 matches found

CVE
CVE
added 2026/09/04 3:33 p.m.5 views

CVE-2026-82911

Roskus Prospero Flow CRM before 5.15.11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the OrderConfirmController at GET /order/confirm/{order_number} . The root cause is that Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE reque...

5.1CVSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/04 12:23 p.m.4 views

CVE-2025-28355

CVE-2025-28355 经发现,https://github.com/Volmarg/personal-management-system 应用程序存在CSRF攻击漏洞,攻击者可执行的操作之一是诱骗合法用户发起跨站请求,从而修改其密码,使攻击者能够访问该应用程序。该漏洞需要浏览器的“SameSite”Cookie属性默认值为 none 的浏览器(如Firefox)才能利用。 向量字符串 : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS评分 : 4.7 概念验证 为进行演示,我将使用用户名 tester,并将其密码更改为...

4.7CVSS5AI score0.00197EPSS
SaveExploits2References1
Github Security Blog
Github Security Blog
added 2026/09/03 7:23 p.m.7 views

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

8.3CVSS5.9AI score0.00237EPSS
SaveExploits0References6Affected Software1
Kitploit
Kitploit
added 2026/09/02 4:23 p.m.4 views

halo-cve-2026-67919

rce del plugin de halo desde una url la consola de halo permite a los administradores instalar y actualizar plugins pegando una url. obtiene cualquier url, instala el jar, y el código del jar se ejecuta en el servidor. no hay comprobaciones de esquema, ni de host, sigue redirecciones, y el gestor...

9.8CVSS5.2AI score0.00831EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 2:47 a.m.7 views

CVE-2026-73292

CVE-2026-73292 – Cambio de contraseña por CSRF en Semaphore UI Solo con fines educativos y de divulgación responsable. Esta vulnerabilidad ha sido reportada en GHSA-8cj9-r88m-8945 y afecta a las versiones de semaphoreui anteriores a la 2.18.21. Vulnerabilidad El endpoint de cambio de contraseña d...

8.3CVSS5.2AI score0.00237EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/31 11:46 a.m.6 views

EUVD-2026-68487

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

4.6CVSS5.8AI score0.00246EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/31 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-47889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8...

7.5CVSS5.9AI score0.00253EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/28 12:00 a.m.36 views

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

9.8CVSS6AI score0.00314EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/27 6:17 a.m.12 views

CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS0.00253EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/27 6:17 a.m.6 views

CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS5.9AI score0.00253EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/27 5:21 a.m.86 views

CVE-2026-47889

CVE-2026-47889 affects Spring Framework WebFlux applications running on the Jetty 12 Core reactive adapter . The JettyCoreServerHttpResponse component serializes response cookies without the SameSite attribute , potentially weakening cookie-based session protection. Affected versions are Spring F...

7.5CVSS5.3AI score0.00253EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 5:21 a.m.9 views

EUVD-2026-66857

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS5.2AI score0.00253EPSS
SaveExploits0References1
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.11 views

Astra Linux – Vulnerability in python-tornado

In Tornado before version 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments of .RequestHandler.setcookie were not checked for crafted characters...

7.2CVSS5.2AI score0.00237EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Firefox and Thunderbird

Requests initiated through the reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

6.1CVSS6.8AI score0.00644EPSS
SaveExploits1References1
Spring Security Advisories
Spring Security Advisories
added 2026/08/20 12:00 a.m.14 views

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

7.5CVSS5.3AI score0.00253EPSS
SaveExploits0
CVE
CVE
added 2026/08/19 3:49 p.m.24 views

CVE-2026-62671

In Grav Login Plugin versions before 3.8.11, the taskRegenerate2FASecret() function is reachable via a top-level GET request with no nonce, Origin, or Referer check. Under SameSite=Lax, an off-site navigation can overwrite a logged-in user's TOTP secret, forcing 2FA re-enrollment. CVSS 5.4 MEDIUM...

5.4CVSS5.3AI score0.00136EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/19 3:49 p.m.34 views

CVE-2026-62671 CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

5.4CVSS0.00136EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/17 11:16 a.m.9 views

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

4.2CVSS0.00103EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/17 11:04 a.m.9 views

EUVD-2026-60086

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

4.2CVSS5.1AI score0.00103EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/17 11:04 a.m.47 views

CVE-2026-74867 SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

4.2CVSS0.00103EPSS
SaveExploits0References2
Rows per page
Query Builder