EPSS
Percentile
31.5%
archivy is vulnerable to cross-site request forgery. The vulnerability exists in the route /dataobj/delete/ of routes.py because the csrf token is not verified which allows an attacker to delete user’s notes.
/dataobj/delete/
github.com/advisories/GHSA-9236-8w7q-rmrv
github.com/archivy/archivy/commit/796c3ae318eea183fc88c87ec5a27355b0f6a99d
huntr.dev/bounties/e204a768-2129-4b6f-abad-e436309c7c32
huntr.dev/bounties/e204a768-2129-4b6f-abad-e436309c7c32/