CSRF
Monthly
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. No public exploit has been identified at time of analysis, but the attack path is technically straightforward and targets a routine administrative workflow that reliably delivers the payload.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Cross-site request forgery in SourceCodester Online Examination & Learning Management System 1.0 enables remote attackers to perform unauthorized state-changing actions on behalf of authenticated users by tricking them into visiting a crafted page or clicking a malicious link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L) confirms the attack is network-initiated without attacker authentication, though victim interaction is required and impact is limited to partial integrity loss within the vulnerable system. No public exploit code or CISA KEV listing exists at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.
Session theft and unauthorized OAuth consent grant in OpenAM Community Edition through 16.0.6 result from the default configuration issuing the iPlanetDirectoryPro SSO cookie with HttpOnly=false and simultaneously reusing that cookie as the CSRF token in OAuth/OIDC consent flows. An authenticated console user who clicks a single attacker-crafted link, when chained with any co-resident same-origin XSS on the OpenAM origin, loses their SSO session and simultaneously completes an attacker-driven OAuth consent grant in one interaction. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the dual-purpose misuse of the session cookie - as both a bearer token and a CSRF guard - substantially amplifies the impact of any XSS present in the same origin.
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.
Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Cross-site request forgery in Budibase's AI chat-link handoff endpoint (GET/POST /api/chat-links/:instance/:token/handoff) permits a same-tenant attacker with low privileges to permanently bind their external chat identity (Slack, Discord, MS Teams, or Telegram) to any authenticated victim user's Budibase account. Because the confirmation token is rendered in plaintext inside the HTML page the victim views and the POST endpoint carries no CSRF protection or session binding, an attacker can extract the token from their own session initiation flow and embed it in a phishing page that auto-submits on load, hijacking the victim's globalUserId mapping. Once bound, the attacker impersonates the victim across all AI agent operations and inherits the victim's workspace permissions on knowledge sources and downstream automations. No public exploit code or KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 8.7 reflects high confidentiality and integrity impact across both the vulnerable system and subsequent downstream systems.
Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283569.
Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory https://www.ibm.com/support/pages/node/7283486.
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.
Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Cross-site request forgery in the ShopEngine Elementor WooCommerce Builder Addon for WordPress (versions before 4.9.3) enables an unauthenticated remote attacker to silently authenticate a victim into an attacker-controlled WordPress account by tricking the victim into visiting a malicious page. When the victim subsequently proceeds to WooCommerce checkout, all billing and shipping details they enter are stored under and readable by the attacker, exposing personally identifiable information. No active exploitation is confirmed (not listed in CISA KEV), the EPSS score is 0.11% (2nd percentile) indicating very low current exploitation probability, and a vendor-released patch is available in version 4.9.3.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.
Insufficient input validation on the `_handler` POST field in Winter CMS's form postback mechanism allows any authenticated backend user to invoke arbitrary controller methods-including protected and private ones-bypassing role-based permission checks. The Users controller compounded this by conditionally nullifying its `$requiredPermissions` for the `myaccount` action, enabling low-privilege backend users to call administrative methods such as `update_onDelete`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` against any backend user record. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is limited to users with active, authenticated backend sessions (CSRF tokens remain enforced).
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.
Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Missing authorization in OpenReception's appointment booking platform (before 1.0.1) lets any unauthenticated network attacker POST to `/setup/create-admin-account` and mint additional GLOBAL_ADMIN accounts on an already-claimed, fully configured instance. The created account is immediately active (`is_active=true`, `confirmation_state=ACCESS_GRANTED`) with no email confirmation, granting full platform-level administrative control and successful login and tenant enumeration. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the root cause is confirmed by the vendor GHSA advisory and fix commit.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged administrative actions on behalf of a logged-in administrator by luring them to a crafted malicious webpage. Affected versions span the 11.x line prior to 11.3.6 and the 12.x line prior to 12.0.3, covering deployments across both active release trains. No public exploit code or active exploitation has been identified; Progress Software has issued patches for both branches.
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Full account takeover in DjangoCRM stems from a hardcoded Django SECRET_KEY committed in webcrm/settings.py, letting anyone who reads the public GitHub repository forge session cookies (including the superadmin), CSRF tokens, and password reset tokens. The default DEBUG=True setting compounds this by exposing database, email, and OAuth credentials plus internal paths on error pages. No public exploit is identified at time of analysis, but exploitation is trivial and requires no authentication (CVSS 9.1, PR:N).
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. No public exploit has been identified at time of analysis, but the attack path is technically straightforward and targets a routine administrative workflow that reliably delivers the payload.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Cross-site request forgery in SourceCodester Online Examination & Learning Management System 1.0 enables remote attackers to perform unauthorized state-changing actions on behalf of authenticated users by tricking them into visiting a crafted page or clicking a malicious link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L) confirms the attack is network-initiated without attacker authentication, though victim interaction is required and impact is limited to partial integrity loss within the vulnerable system. No public exploit code or CISA KEV listing exists at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.
Session theft and unauthorized OAuth consent grant in OpenAM Community Edition through 16.0.6 result from the default configuration issuing the iPlanetDirectoryPro SSO cookie with HttpOnly=false and simultaneously reusing that cookie as the CSRF token in OAuth/OIDC consent flows. An authenticated console user who clicks a single attacker-crafted link, when chained with any co-resident same-origin XSS on the OpenAM origin, loses their SSO session and simultaneously completes an attacker-driven OAuth consent grant in one interaction. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the dual-purpose misuse of the session cookie - as both a bearer token and a CSRF guard - substantially amplifies the impact of any XSS present in the same origin.
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.
Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Cross-site request forgery in Budibase's AI chat-link handoff endpoint (GET/POST /api/chat-links/:instance/:token/handoff) permits a same-tenant attacker with low privileges to permanently bind their external chat identity (Slack, Discord, MS Teams, or Telegram) to any authenticated victim user's Budibase account. Because the confirmation token is rendered in plaintext inside the HTML page the victim views and the POST endpoint carries no CSRF protection or session binding, an attacker can extract the token from their own session initiation flow and embed it in a phishing page that auto-submits on load, hijacking the victim's globalUserId mapping. Once bound, the attacker impersonates the victim across all AI agent operations and inherits the victim's workspace permissions on knowledge sources and downstream automations. No public exploit code or KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 8.7 reflects high confidentiality and integrity impact across both the vulnerable system and subsequent downstream systems.
Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283569.
Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory https://www.ibm.com/support/pages/node/7283486.
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.
Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Cross-site request forgery in the ShopEngine Elementor WooCommerce Builder Addon for WordPress (versions before 4.9.3) enables an unauthenticated remote attacker to silently authenticate a victim into an attacker-controlled WordPress account by tricking the victim into visiting a malicious page. When the victim subsequently proceeds to WooCommerce checkout, all billing and shipping details they enter are stored under and readable by the attacker, exposing personally identifiable information. No active exploitation is confirmed (not listed in CISA KEV), the EPSS score is 0.11% (2nd percentile) indicating very low current exploitation probability, and a vendor-released patch is available in version 4.9.3.
Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.
Insufficient input validation on the `_handler` POST field in Winter CMS's form postback mechanism allows any authenticated backend user to invoke arbitrary controller methods-including protected and private ones-bypassing role-based permission checks. The Users controller compounded this by conditionally nullifying its `$requiredPermissions` for the `myaccount` action, enabling low-privilege backend users to call administrative methods such as `update_onDelete`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` against any backend user record. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is limited to users with active, authenticated backend sessions (CSRF tokens remain enforced).
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.
Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Missing authorization in OpenReception's appointment booking platform (before 1.0.1) lets any unauthenticated network attacker POST to `/setup/create-admin-account` and mint additional GLOBAL_ADMIN accounts on an already-claimed, fully configured instance. The created account is immediately active (`is_active=true`, `confirmation_state=ACCESS_GRANTED`) with no email confirmation, granting full platform-level administrative control and successful login and tenant enumeration. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the root cause is confirmed by the vendor GHSA advisory and fix commit.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged administrative actions on behalf of a logged-in administrator by luring them to a crafted malicious webpage. Affected versions span the 11.x line prior to 11.3.6 and the 12.x line prior to 12.0.3, covering deployments across both active release trains. No public exploit code or active exploitation has been identified; Progress Software has issued patches for both branches.
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Full account takeover in DjangoCRM stems from a hardcoded Django SECRET_KEY committed in webcrm/settings.py, letting anyone who reads the public GitHub repository forge session cookies (including the superadmin), CSRF tokens, and password reset tokens. The default DEBUG=True setting compounds this by exposing database, email, and OAuth credentials plus internal paths on error pages. No public exploit is identified at time of analysis, but exploitation is trivial and requires no authentication (CVSS 9.1, PR:N).
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.