EUVD-2026-16803Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. If you want to get best quality of vulnerability data, you may have to visit VulDB.
AnalysisAI
Cross-site request forgery (CSRF) in SourceCodester Note Taking App up to version 1.0 allows remote attackers to perform unauthorized actions via crafted requests, exploiting lack of CSRF token validation. The vulnerability requires user interaction (clicking a malicious link) but carries no authentication barrier. Publicly available exploit code exists, elevating practical risk despite the moderate CVSS score of 4.3.
Technical ContextAI
The vulnerability stems from insufficient CSRF protections in the Note Taking App's request handling, classified under CWE-352 (Cross-Site Request Forgery). CSRF attacks exploit the trust a web application places in authenticated user sessions: when a victim visits an attacker-controlled site while logged into the Note Taking App, the attacker can craft requests that the victim's browser automatically includes with valid session credentials. The affected application (CPE: cpe:2.3:a:sourcecodester:note_taking_app:*:*:*:*:*:*:*:*) does not implement standard defenses such as synchronizer tokens, SameSite cookie attributes, or same-origin policy enforcement. The CVSS vector confirms remote network-based attack (AV:N), low complexity (AC:L), and no privilege requirements (PR:N), but requires user interaction (UI:R) to trigger.
RemediationAI
Upgrade to a patched version of SourceCodester Note Taking App beyond 1.0 if available from the vendor. Primary mitigation involves implementing CSRF token validation on all state-changing requests (POST, PUT, DELETE, PATCH): generate unique, unpredictable tokens per session or per request, embed them in forms and AJAX headers, and validate on the server side before processing. Additionally, deploy SameSite=Strict or SameSite=Lax cookie attributes to restrict automatic session cookie inclusion in cross-origin requests. Consult the vendor advisory at https://www.sourcecodester.com/ for specific patched releases. If upgrade is not immediately available, implement Web Application Firewall (WAF) rules to detect and block requests lacking valid CSRF tokens.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today