EUVD-2026-69283
GHSA-776w-f37g-r7x3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Web-accessible application, no attacker privileges needed, but user interaction required to trigger forged request; integrity impact high, confidentiality low, no availability impact.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery.
This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
AnalysisAI
Cross-Site Request Forgery in Talassoft Industrial Management Software (versions V.4 through V.15) enables a remote unauthenticated attacker to induce an authenticated user's browser to submit unauthorized state-changing requests to the application. The high integrity impact (I:H per CVSS) indicates that successfully forged requests can alter industrial management data or configurations without the victim's knowledge. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim hold an active, authenticated session in Talassoft Industrial Management Software at the time of the attack, and that the attacker successfully induce the victim to load or interact with attacker-controlled content (e.g., visit a malicious URL or page). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 reflects a meaningful but bounded risk profile: low attack complexity and no privilege requirement lower the bar for exploitation, while the mandatory user-interaction (UI:R) and unchanged scope (S:U) limit the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Talassoft Industrial Management Software to version V.16 or later, which resolves this vulnerability according to the affected-version range in the NVD description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Talassoft Industrial Management Software versions V.4-V.15 and assess their external exposure; notify operational and security stakeholders of the vulnerability and interim mitigation requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today