23418 matches found
CVE-2021-29349
CVE-2021-29349 CVE-2021-29349 CSRF para eliminar todos los mensajes en Mahara 20.10 Payload y crédito https://github.com/0xBaz...
CVE-2018-8718
Título del Exploit : Jenkins Vulnerabilidad CSRF del plugin mailer - Enviar correo CSRF Fecha : 2018/06/05 Autor del Exploit : Yeom Geun Cheol Página del proveedor : https://jenkins.io/ Enlace del software : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi Versión: Versiones...
CVE-2024-51435
bloodbank Un sencillo PoC de csrf encontrado en Blood Bank System v 1.0...
Ozette Plugins - Cross-Site Request Forgery
An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC Panoramica PoC della CVE-2019-9787 CSRF Versione WordPress 5.0 riferimento Non usarlo se non per scopi di test. Installazione $ docker-compose up -d 1. accedi a http://localhost:8080/ e installa WordPress. devi solo creare un account amministratore WP. 2. accedi a...
CVE-2023-45857-Demo
Demo para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar en el dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Comprobar en las herramientas de desarrollo del navegador que la cookie XSRF-TOKEN se ha establecido...
vertx-web-xsrf
Resumen La implementación CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl en Vert.x Web no crea tokens CSRF únicos por sesión de usuario. Un sitio web malicioso aún puede realizar CSRF obteniendo un token CSRF válido y agregándolo a un formulario HTML, y luego enviando el formulario...
inference-gateway-PoC
inference-gateway: security advisory | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440 Advisory| GHSA-5293-fcm6-fh8v CVE| CVE-2026-87009 CVSS 3.1| 5.4 Medium — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Weakness| CWE-352, CWE-306, CWE-346 Status| Fixed in v0.46.0 Summary : inference-gatew...
halo-cors-csrf-CVE-2026-67921
CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...
CVE-2025-70899
Este repositorio contiene la Prueba de Concepto que demuestra la vulnerabilidad de protección CSRF faltante en el Sistema de Registro de Cursos en Línea de PHPgurukul. 📄 Vea el PoC completo aquí: MissingCSRFprotectionpoc.md...
CVE-2020-23590
CVE-2020-23590 OPTILINK E-PON "N.º DE MODELO: OP-XT71000N" con "VERSIÓN DE HARDWARE: V2.2"; & "VERSIÓN DE FIRMWARE: OPV3.3.1-191028" Vulnerabilidad encontrada en el "Optilink OP-XT71000N Versión de hardware: V2.2, Versión de firmware: OPV3.3.1-191028" que permite a un atacante remoto no autentica...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...
Astra Linux – Vulnerability in etcd
A cross-site request forgery flaw was discovered in etcd 3.3.1 and earlier. An attacker can create a website that attempts to send a POST request to the etcd server and modify a key. Adding a key is done using a PUT operation, so it seems theoretically safe but PUT operations cannot be performed...
EUVD-2026-76198
Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...
CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
EUVD-2026-76204
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62133
WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...
CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...