Monthly
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Cross-site request forgery in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows a remote unauthenticated attacker to perform unauthorized state-changing operations on an industrial DC power monitoring device by tricking an authenticated administrator into visiting a malicious webpage. Reported via CISA ICS-CERT advisory ICSA-26-246-08, the vulnerability is rooted in a missing anti-CSRF mechanism in the device web interface; a firmware upgrade to v2.4.2 is available. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the OT deployment context elevates operational consequence.
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Cross-site request forgery in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows a remote unauthenticated attacker to perform unauthorized state-changing operations on an industrial DC power monitoring device by tricking an authenticated administrator into visiting a malicious webpage. Reported via CISA ICS-CERT advisory ICSA-26-246-08, the vulnerability is rooted in a missing anti-CSRF mechanism in the device web interface; a firmware upgrade to v2.4.2 is available. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the OT deployment context elevates operational consequence.
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.