Lucene search
+L

772 matches found

CVE
CVE
added 2026/09/04 3:33 p.m.7 views

CVE-2026-82911

Roskus Prospero Flow CRM before 5.15.11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the OrderConfirmController at GET /order/confirm/{order_number} . The root cause is that Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE reque...

5.1CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 3:33 p.m.4 views

EUVD-2026-71268

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

5.1CVSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/04 12:23 p.m.4 views

CVE-2025-28355

CVE-2025-28355 https://github.com/Volmarg/personal-management-system 애플리케이션은 CSRF 공격에 취약한 것으로 확인되었습니다. 공격자가 수행할 수 있는 많은 작업 중 하나는 합법적인 사용자를 속여 비밀번호를 변경하는 교차 사이트 요청을 실행하게 하여 공격자가 애플리케이션에 접근할 수 있도록 하는 것입니다. 이 취약점은 Firefox와 같이 "SameSite" 쿠키 속성 기본값이 none인 브라우저가 필요합니다. 벡터 문자열 :...

4.7CVSS5AI score0.00197EPSS
SaveExploits2References1
Github Security Blog
Github Security Blog
added 2026/09/03 7:23 p.m.7 views

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

8.3CVSS5.9AI score0.00237EPSS
SaveExploits0References6Affected Software1
Kitploit
Kitploit
added 2026/09/02 4:23 p.m.4 views

halo-cve-2026-67919

URL을 통한 halo 플러그인 RCE halo 콘솔을 사용하면 관리자가 URL을 붙여넣어 플러그인을 설치하거나 업그레이드할 수 있습니다. 임의의 URL을 가져와 jar를 설치하며, jar의 코드가 서버에서 실행됩니다. 스킴 검사도, 호스트 검사도 없고 리디렉션을 따라가며, 플러그인 관리자는 jar에서 확장 클래스를 직접 로드합니다. 이것은 cve-2026-67919install-from-uri / upgrade-from-uri, cve-2026-67920migration restore, cve-2026-67921csrf/co...

9.8CVSS5.2AI score0.00831EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 2:47 a.m.7 views

CVE-2026-73292

CVE-2026-73292 – Semaphore UI 교육 및 책임 있는 공개 목적으로만 사용하세요. 이 취약점은 GHSA-8cj9-r88m-8945에 보고되었으며 semaphoreui 2.18.21 미만 버전에 영향을 미칩니다. 취약점 Semaphore UI의 비밀번호 변경 엔드포인트에는 CSRF 보호가 구현되어 있지 않습니다: CSRF 토큰이 필요하지 않음 현재 비밀번호 확인이 필요하지 않음 인증은 SameSite 적용 없이 세션 쿠키semaphore에만 의존합니다 악성 페이지는 방문한 인증된 사용자의 비밀번호를 사용자 모...

8.3CVSS5.2AI score0.00237EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/31 11:46 a.m.6 views

EUVD-2026-68487

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

4.6CVSS5.8AI score0.00246EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/31 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-47889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8...

7.5CVSS5.9AI score0.00253EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/28 12:00 a.m.37 views

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

9.8CVSS6AI score0.00314EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/27 6:17 a.m.12 views

CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS0.00253EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/27 6:17 a.m.6 views

CVE-2026-47889

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS5.9AI score0.00253EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/27 5:21 a.m.86 views

CVE-2026-47889

CVE-2026-47889 affects Spring Framework WebFlux applications running on the Jetty 12 Core reactive adapter . The JettyCoreServerHttpResponse component serializes response cookies without the SameSite attribute , potentially weakening cookie-based session protection. Affected versions are Spring F...

7.5CVSS5.3AI score0.00253EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 5:21 a.m.9 views

EUVD-2026-66857

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

7.5CVSS5.2AI score0.00253EPSS
SaveExploits0References1
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.11 views

Astra Linux – Vulnerability in python-tornado

In Tornado before version 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments of .RequestHandler.setcookie were not checked for crafted characters...

7.2CVSS5.2AI score0.00237EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Firefox and Thunderbird

Requests initiated through the reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

6.1CVSS6.8AI score0.00644EPSS
SaveExploits1References1
Spring Security Advisories
Spring Security Advisories
added 2026/08/20 12:00 a.m.14 views

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

7.5CVSS5.3AI score0.00253EPSS
SaveExploits0
CVE
CVE
added 2026/08/19 3:49 p.m.24 views

CVE-2026-62671

In Grav Login Plugin versions before 3.8.11, the taskRegenerate2FASecret() function is reachable via a top-level GET request with no nonce, Origin, or Referer check. Under SameSite=Lax, an off-site navigation can overwrite a logged-in user's TOTP secret, forcing 2FA re-enrollment. CVSS 5.4 MEDIUM...

5.4CVSS5.3AI score0.00136EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/19 3:49 p.m.34 views

CVE-2026-62671 CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...

5.4CVSS0.00136EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/17 11:16 a.m.9 views

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

4.2CVSS0.00103EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/17 11:04 a.m.9 views

EUVD-2026-60086

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

4.2CVSS5.1AI score0.00103EPSS
SaveExploits0References2
Rows per page
Query Builder