77 matches found
askWAM
askWAM askWAM 通过 Windows Web 账户管理器（WAM）静默请求 Microsoft Entra 访问令牌。它提供三种形式：.NET Framework 客户端、独立的原生 x64 客户端，以及带有 CNA 命令适配器的 x64 Beacon Object File。 所有前端都可以枚举客户端可见的账户，并通过其不透明的 WAM 账户 ID 或精确用户名来定位某个身份。它们绝不会回退到交互式身份验证。 通过此流程请求的令牌将继承以下详细信息： 用户身份验证方法 设备状态，例如合规/混合加入或托管 这种请求令牌的方式在强制执行令牌保护（Token...
CVE-2026-85162
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...
CVE-2026-16547
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...
PT-2026-67664
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...
EUVD-2026-52257
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...
Litestar has HTML Injection Through its CSRF Token
Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the function parameter, which is concatenated into an API error message and rendered without HTML escaping. An attacker can execute arbitrary JavaScript code in the context of a backend user's session by...
CVE-2026-34228
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This...
EUVD-2026-17639
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins...
EUVD-2026-17628
Admidio is an open-source user management solution. Prior to version 5.0.8, the createuser, assignmember, and assignuser action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the deleteuser mode in the same file which...
CVE-2026-33373
An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...
CVE-2026-27146
GetSimple CMS is affected by a CSRF on the administrative file upload endpoint across all versions due to missing CSRF protection. An attacker can craft a malicious page that silently triggers a file upload from an authenticated admin user’s browser without a token or origin validation, enabling ...
The vulnerability of the Jose4j JWT library, related to improper protection of security tokens, allows a attacker to trigger a service failure.
The vulnerability of the Jose4j JWT library is related to improper protection of security tokens. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
CVE-2025-61547
Cross-Site Request Forgery CSRF is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 fixed in 19.76. The application does not implement proper CSRF tokens or other other protective measures, allowing a remote attacker to trick authenticated users into...
PT-2025-49550
Some endpoints in vulnerability-lookup that modified application state e.g. changing database entries, user data, configurations, or other privileged actions may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site...
Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently respect granted scopes, it affects all access checks that are based...
EUVD-2021-30133
Malicious code in bioql PyPI...
EUVD-2021-30132
Malicious code in bioql PyPI...
