EUVD-2026-16740Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
AnalysisAI
Cross-site request forgery (CSRF) in SourceCodester Diary App 1.0 allows unauthenticated remote attackers to manipulate an unknown function within diary.php, potentially leading to unauthorized state-changing actions. The vulnerability has a moderate CVSS score of 5.3 with user interaction required, and publicly available exploit code exists, though active exploitation status is unconfirmed. An attacker could craft malicious web pages to trick users into performing unwanted actions within the application.
Technical ContextAI
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a well-documented class of web application flaws where an application fails to validate or enforce CSRF tokens on state-changing operations. SourceCodester Diary App 1.0 is a PHP-based web application (CPE: cpe:2.3:a:sourcecodester:diary_app:*:*:*:*:*:*:*:*) where the affected diary.php file processes requests without sufficient CSRF protections. The vulnerability exists in an unidentified function within this file, suggesting that input validation and anti-CSRF mechanisms (such as token generation, validation, or SameSite cookie attributes) are either absent or improperly implemented. The attack vector is network-based with low complexity and no privilege requirements, indicating the flaw can be exploited from any network location without prior authentication or special system access.
RemediationAI
Contact SourceCodester or check https://www.sourcecodester.com/ for a patched version of Diary App, as no specific fixed version number is documented in the provided intelligence. As a temporary mitigation pending a vendor patch, implement anti-CSRF protections: ensure the application generates and validates unique CSRF tokens on all state-changing operations (POST, PUT, DELETE), enforce SameSite=Strict or SameSite=Lax cookie attributes, and validate the Origin and Referer HTTP headers. Additionally, deploy a Web Application Firewall (WAF) configured to detect and block common CSRF attack patterns. If the application is publicly accessible, restrict access to authenticated users only and educate users not to follow untrusted links while logged into the application. For development environments or instances not requiring public availability, consider running the application behind a reverse proxy that enforces additional CSRF protections.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today