Monthly
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
FrontAccounting 2.4.20 and earlier selectively enforces CSRF validation - tokens are generated for every rendered form but the validation call is absent from all financial transaction handlers, including journal entries, supplier invoices, customer payments, bank transactions, and company configuration. An attacker who can induce an authenticated FrontAccounting user to visit a malicious page can silently forge any of those POST requests under the victim's live session, recording fraudulent accounting data without the victim's awareness. No public exploit identified at time of analysis, though a detailed researcher disclosure with technical specifics is publicly available on GitHub.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
FrontAccounting 2.4.20 and earlier selectively enforces CSRF validation - tokens are generated for every rendered form but the validation call is absent from all financial transaction handlers, including journal entries, supplier invoices, customer payments, bank transactions, and company configuration. An attacker who can induce an authenticated FrontAccounting user to visit a malicious page can silently forge any of those POST requests under the victim's live session, recording fraudulent accounting data without the victim's awareness. No public exploit identified at time of analysis, though a detailed researcher disclosure with technical specifics is publicly available on GitHub.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.