CSRF
Monthly
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Cross-Site Request Forgery in the FuseWP WordPress plugin (all versions ≤ 1.1.24.2) allows unauthenticated attackers to toggle email-marketing sync rule states by tricking an authenticated administrator into triggering a forged request. The root cause is missing nonce verification on the toggle_sync_status() AJAX handler in AjaxHandler.php (line 149), meaning WordPress's built-in CSRF protection is entirely absent for that state-changing action. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.3 Medium correctly reflects the limited impact scope - the attacker can only enable or disable sync rules, not read data or execute code.
Cross-Site Request Forgery in Apache Zeppelin 0.6.0 through 0.12.0 allows an attacker who lures an authenticated user to a malicious webpage to perform unauthorized actions across the full REST API and WebSocket endpoint surface on the victim's behalf. The vulnerability stems from a permissive default CORS configuration combined with server-side acceptance of text/plain request bodies - a combination that bypasses standard browser preflight CSRF defenses without requiring any special exploit code. No public exploit or CISA KEV listing has been identified; the vendor rates this moderate and has released a patch in version 0.12.1.
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Reflected XSS in OpenAM's OAuth2/OIDC consent page allows attackers to execute arbitrary JavaScript in the victim's authenticated session, enabling session theft and administrative takeover. Affects OpenAM versions 13.0.0 through 16.1.1. No active exploitation confirmed, but the attack vector is straightforward and publicly documented.
Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at `/api/auth/setup` in `web/backend/api/auth.go` accepted POST requests without validating `Origin`, `Referer`, or `Sec-Fetch-Site` headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
CSRF in grav-plugin-login before 3.8.11 allows a remote unauthenticated attacker to rotate a logged-in victim's TOTP secret by luring them to an attacker-controlled page that performs a top-level GET navigation to the Grav site's regenerate2FASecret task endpoint. Because Grav dispatches frontend tasks via GET URI parameters and the default SameSite=Lax session cookie policy permits cross-origin top-level GET navigations to carry cookies, the victim's authenticator app is silently invalidated, forcing 2FA re-enrollment - though the attacker gains no account access. No public exploit has been identified at time of analysis; CVSS 4.0 score is 2.3, reflecting genuinely low severity.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Cross-Site Request Forgery in the Appointment Booking Plugin for WordPress (versions before 5.6.3) allows an unauthenticated attacker to perform privileged administrative actions - including overwriting the booking-form configuration and disconnecting the connected payment gateway - by tricking a logged-in administrator into clicking a malicious link or visiting an attacker-controlled page. The root cause is absent CSRF nonce validation across multiple state-changing actions handled by the plugin's central request dispatcher. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS sits at 0.10% (1st percentile), indicating negligible observed exploitation activity and no CISA KEV listing at time of analysis.
Cross-site request forgery in the Landing Page Builder - Coming Soon Page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin (all versions up to and including 1.5.3.6) allows unauthenticated remote attackers to manipulate arbitrary WordPress posts by sending a forged AJAX request that inherits an authenticated editor or administrator's browser session. Missing nonce validation on the ulpb_admin_ajax function means a victim who clicks a crafted link while logged in unknowingly authorizes post creation, modification of titles, slugs, types, status, and injection of ULPB_DATA post meta. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified; EPSS data was not provided in available intelligence.
Authenticated operator access in nebula-mesh v0.3.0-v0.3.8 allows bypassing the configured enrollment token lifetime policy: the Web UI host-creation path (POST /ui/hosts) hardcodes a 24-hour bearer token expiry in internal/web/handlers.go:879, silently ignoring both server-wide and per-network enrollment_token_ttl settings that the API sibling path (internal/api/hosts.go:190-196) correctly honors via the tokenTTLFor resolver. Enrollment tokens are bearer credentials for the public POST /api/v1/enroll endpoint; a token with a longer-than-intended TTL widens the window in which a copied, logged, or leaked token can enroll a pending Nebula host and retrieve its signed certificate and configuration. Publicly available exploit code (a reproducible Go unit test) confirms the bypass on v0.3.8; no public exploit identified at time of analysis beyond this PoC; a vendor-released patch exists in v0.5.0.
Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `'` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.
Cross-site request forgery in Kimai's timesheet API allows an unauthenticated attacker to trigger unauthorized state changes against any logged-in victim by embedding malicious GET requests in attacker-controlled pages. Kimai versions up to and including 2.57.0 expose the `stop` and `restart` timesheet operations as HTTP GET routes, which browsers will follow automatically using the victim's active session cookie - no CSRF token is required. Impact is limited to timesheet data integrity and availability (corrupted time records, unauthorized entries, billing distortion), not system compromise; no public exploit is confirmed at time of analysis, and no active exploitation has been reported by CISA KEV.
CSRF vulnerabilities in Kimai 2.56.0 through 2.57.0 allow an unauthenticated attacker to manipulate the authorization topology of the time-tracking application by tricking a privileged logged-in user into visiting a malicious page. The three affected GET endpoints - for projects, customers, and activities - perform persistent writes: creating or reusing a Team, assigning the victim as teamlead, and binding the target object to that team. No public exploit is currently available at time of analysis, though a PoC was submitted to the vendor and subsequently removed; the fix (moving routes to POST endpoints) shipped in version 2.58.0.
HedgeDoc's GitHub Gist export feature exposes private and protected note content to attacker-controlled GitHub accounts via OAuth2 state parameter forgery. Versions prior to 1.11.0 generated an OAuth2 state token during the Gist export flow but validated only its presence - not its binding to the initiating user session - enabling a cross-site request forgery attack. An attacker who tricks a logged-in victim into clicking a crafted callback URL can redirect the victim's note export to the attacker's own GitHub Gist, bypassing any note visibility controls. No public exploit code or CISA KEV listing is identified at time of analysis, but a confirmed patch exists in version 1.11.0.
Stored XSS in Laravel-Mediable before 7.0.0 allows network-accessible, unauthenticated attackers to persist malicious JavaScript payloads by uploading crafted SVG files containing embedded scripts in onload handlers, script tags, or foreignObject elements. When any authenticated user subsequently opens or previews a poisoned file in their browser, the payload executes with full DOM access, enabling session cookie theft, CSRF token capture, and complete account takeover. No public exploit has been identified at time of analysis, but the attack requires no special privileges and the technique is well-understood; the vendor has classified this as a security release and strongly recommends immediate upgrade to 7.0.0.
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP GET requests while exempting GET from its anti-CSRF header validation, enabling two distinct attack paths: a classic CSRF attack requiring a logged-in administrator to visit a crafted URL, and a fully unauthenticated path exploitable from localhost against default installations. Successful exploitation allows account creation, configuration modification, and ultimately remote code execution on the HFS host. Patch version 3.2.1 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery in the Drupal Ray Enterprise Translation contrib module lets a remote attacker forge state-changing requests that are executed with the privileges of an authenticated victim (typically a site administrator), potentially altering translation configuration and integrations. It affects module versions below 4.0.4, below 4.1.4, and below 11.0.4, and carries a vendor CVSS of 8.8. No public exploit has been identified at time of analysis and the EPSS score is very low (0.12%, 2nd percentile), indicating no observed exploitation activity.
Cross-Site Request Forgery in the Drupal Salesforce Suite contrib module (all versions from 0.0.0 up to and including 5.1.3) lets an attacker forge state-changing requests that are executed with the privileges of an authenticated Drupal user who is tricked into loading attacker-controlled content. The Drupal security team (SA-CONTRIB-2026-063) rates it critical, and a fixed release is available; no public exploit code has been identified and EPSS is very low (0.10%, 1st percentile), indicating no observed exploitation activity. Note that the published CVSS vector (UI:N) is atypical for CSRF, which normally depends on victim interaction, so the real-world impact profile should be verified against the vendor advisory.
Cross-Site Request Forgery in the GoodMeet WordPress plugin (versions up to and including 1.1.8) enables unauthenticated remote attackers to wipe a site's stored Google Meet API credentials and OAuth tokens by deceiving a logged-in administrator into triggering a crafted request. The vulnerable reset_credential() function handling the wp_ajax_goodmeet_reset_google_meet_credential AJAX action checks the manage_options capability but omits mandatory WordPress nonce validation, allowing any cross-origin request to be processed as legitimate. The practical outcome is complete disabling of the site's Google Meet integration with no data disclosure; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in YesWiki's Bazar form module allows a privileged form editor to inject persistent script payloads into field label and hint fields, which execute in the browser context of every subsequent visitor - including unauthenticated guests - who renders an affected form. The vulnerability is a sibling class of an incomplete fix at commit e6b66aa: that commit removed the dangerous |raw('html') filter from two Twig template call sites but left eleven additional sites in range.twig, email.twig, layouts/input.twig, layouts/field.twig, textarea.twig, user.twig, bookmarklet.twig, subscribe.twig, and linked-entry.twig still suppressing Twig's HTML auto-escaping. No active exploitation is confirmed in CISA KEV, but a detailed proof-of-concept with exact payloads, rendered HTML output, and affected line numbers is included in GitHub Security Advisory GHSA-xc7j-3g8q-9vh4, and patch commit 5d1a4d07 is publicly available.
Cross-site request forgery in Admidio's plugin management endpoint (`modules/plugins.php`) enables a remote attacker to trigger destructive plugin operations - including irreversible DROP TABLE SQL execution - against any authenticated administrator who visits an attacker-controlled web page. The endpoint processes install, uninstall, and update operations via unauthenticated GET requests lacking CSRF token validation, and SameSite=Lax cookie behavior causes browsers to automatically include session credentials on top-level GET navigations from cross-origin pages. A working Playwright-based proof-of-concept is publicly available demonstrating the full attack chain; no confirmed active exploitation (CISA KEV) is present at time of analysis.
Cross-Site Request Forgery in HP IP phones' web management interface allows an attacker who has obtained a stolen session cookie to submit unauthorized state-changing requests that modify the phone's webpage contents, with integrity and availability rated high (VI:H/VA:H) in the vendor-supplied CVSS 4.0 vector. The CVSS 4.0 score of 6.0 reflects the attack conditions prerequisite (AT:P) of prior cookie theft, low-level privilege requirement (PR:L), and passive user interaction (UI:P), meaningfully limiting opportunistic exploitation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Cross-Site Request Forgery in Waku's RSC request dispatcher allows a remote attacker to invoke any state-mutating 'use server' server action with a victim's session cookies by exploiting the complete absence of Origin header validation in the core request handler at packages/waku/src/lib/utils/request.ts. Both the RSC path prefix branch (exploitable via Content-Type: text/plain, no preflight) and the progressive-enhancement HTML form branch (exploitable via multipart/form-data) are unguarded, with opaque-origin contexts such as sandboxed iframes and browser extension pages additionally exploitable via Origin: null. The reporter confirmed a working proof-of-concept against waku 1.0.0-beta.0 with dynamic verification on 2026-05-17; all HTTP adapters share the same vulnerable dispatcher and no patched version has been identified at time of analysis.
Cross-site request forgery in Flask-MonitoringDashboard up to version 5.0.2 allows a remote unauthenticated attacker to trick an authenticated dashboard user into submitting malicious state-changing requests by luring them to a crafted page. The vulnerability (CWE-352) is limited in scope to the monitoring dashboard itself with a low integrity impact and no confidentiality or availability consequence, reflected in the CVSS 4.0 score of 2.1. Exploit details have been publicly disclosed via VulDB submissions and a GitHub issue report, but no patch has been released and the project maintainer has not yet responded to the responsible disclosure.
Cross-Site Request Forgery in Smash Balloon Social Photo Feed - Easy Social Feeds Plugin for WordPress (all versions through 6.11.1) enables unauthenticated remote attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by forging a request that a logged-in administrator unwittingly executes. The root cause is missing or incorrect nonce validation on the `maybe_connection_data` function, WordPress's primary CSRF defense mechanism. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch changeset is confirmed in the WordPress plugin repository.
Cross-Site Request Forgery in the Wp Js Detect WordPress plugin (all versions ≤ 1.0.9) permits unauthenticated attackers to overwrite the plugin's frontend notification text and CSS settings by exploiting absent nonce validation in the plugin_settings function. Because the stored values are echoed unescaped to the WordPress frontend, a successful forged request can inject arbitrary HTML or script content visible to site visitors who have JavaScript disabled. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; EPSS data was not supplied.
Cross-site request forgery in new-api's OAuth account binding endpoints allows an unauthenticated network attacker to silently rebind a logged-in user's email or WeChat identity to attacker-controlled credentials by luring the victim to a malicious page. Affected are all deployments running versions prior to v0.12.0-alpha.1 where the GET-based bind endpoints are reachable. No public exploit has been identified at time of analysis, and the default SameSite=Strict cookie configuration substantially limits real-world exploitability to environments that have weakened or overridden that default.
Cross-site request forgery in SEIKO EPSON Web Config allows a remote, unauthenticated attacker to trigger unintended configuration changes on Epson network devices by luring an authenticated administrator into visiting a malicious web page. The vulnerability (CWE-352) requires no privileges on the attacker's side but depends on an active, authenticated Web Config session on the victim's browser. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in imhamzaazam ecommerceFlask allows a remote, unauthenticated attacker to induce authenticated victims into executing unauthorized state-changing actions against the application. The vulnerability exists in an unspecified function of the Flask-based e-commerce application up to commit cb7d9e24c30a99379651b7493b32048126ef402b, with no patch released and the project maintainer not yet responding. A publicly available proof-of-concept exploit has been disclosed via a GitHub issue, and the application's rolling release model means no fixed version can be identified.
Cross-Site Request Forgery in the CrawlWP SEO WordPress plugin (versions through 3.0.16) allows an unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated site administrator. Exploitation requires social engineering - a logged-in admin must be tricked into visiting a malicious page that silently submits a forged request. The integrity impact is low, limited to unauthorized configuration changes within the plugin's functionality. No public exploit code or active exploitation has been identified at time of analysis, consistent with the vulnerability's low CVSS base score of 4.3.
Cross-site request forgery in webpack-dev-server 5.2.5 and earlier allows any website visited by a developer to silently invoke two unauthenticated state-changing endpoints - `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` - via simple browser-initiated GET requests that carry no CSRF protection. An attacker controlling a web page visited during an active dev session can open arbitrary local files in the developer's editor (including files outside the project root) and trigger repeated forced recompilations that degrade workstation performance. No public exploit has been identified at time of analysis, and exploitation is confined to developer workstations rather than production infrastructure.
Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-impacting actions against authenticated WordPress users without their consent. The CVSS vector (C:N/I:N/A:H) indicates this CSRF leads to a destructive availability outcome - likely deletion or corruption of booking/scheduling data - rather than data theft or code execution. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and no required privileges for staging the attack make social-engineering delivery straightforward.
Cross-Site Request Forgery in the Werkstatt WordPress theme (FuelThemes) version 4.7.2 and earlier allows remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated WordPress users. The flaw stems from missing or inadequate CSRF token validation on one or more theme action endpoints, meaning a crafted web page or link can silently trigger privileged operations when visited by a logged-in user. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-Site Request Forgery in GiveWP - Donation Plugin and Fundraising Platform (versions up to and including 4.15.3) allows unauthenticated remote attackers to disable donation email notifications by tricking a logged-in administrator into clicking a crafted link. The root cause is absent nonce validation in the give_set_notification_status_handler() AJAX handler, permitting forged state-changing requests. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, the integrity impact - silently disabling donation notifications - could cause operational blind spots for nonprofit or fundraising site operators.
Cross-site request forgery in the Wikimedia Foundation's MediaWiki RedirectManager Extension (all versions before 1.3.3) enables remote attackers to perform unauthorized redirect management actions on behalf of authenticated wiki users. The CVSS 4.0 base score of 6.9 (Medium) reflects network-accessible exploitation with low impact across confidentiality, integrity, and availability dimensions on both vulnerable and subsequent systems. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Cross-origin data leakage in Google Chrome's SVG implementation prior to version 150.0.7871.47 allows a remote attacker to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw exploits improper SVG handling that bypasses same-origin policy protections, exposing potentially sensitive session data or authenticated content from third-party origins. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS stands at 0.17% (7th percentile), indicating low observed exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's DevTools component (versions prior to 150.0.7871.47) permits a remote attacker to exfiltrate data across origin boundaries by tricking a user into performing specific UI gestures on a crafted HTML page. The CVSS base score of 3.1 (Low) reflects high attack complexity and mandatory user interaction, consistent with the EPSS score of 0.21% (11th percentile) indicating negligible in-the-wild exploitation activity. No public exploit code is identified and no CISA KEV listing exists; a vendor patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.
Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Cross-Site Request Forgery in the FuseWP WordPress plugin (all versions ≤ 1.1.24.2) allows unauthenticated attackers to toggle email-marketing sync rule states by tricking an authenticated administrator into triggering a forged request. The root cause is missing nonce verification on the toggle_sync_status() AJAX handler in AjaxHandler.php (line 149), meaning WordPress's built-in CSRF protection is entirely absent for that state-changing action. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.3 Medium correctly reflects the limited impact scope - the attacker can only enable or disable sync rules, not read data or execute code.
Cross-Site Request Forgery in Apache Zeppelin 0.6.0 through 0.12.0 allows an attacker who lures an authenticated user to a malicious webpage to perform unauthorized actions across the full REST API and WebSocket endpoint surface on the victim's behalf. The vulnerability stems from a permissive default CORS configuration combined with server-side acceptance of text/plain request bodies - a combination that bypasses standard browser preflight CSRF defenses without requiring any special exploit code. No public exploit or CISA KEV listing has been identified; the vendor rates this moderate and has released a patch in version 0.12.1.
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.
Reflected XSS in OpenAM's OAuth2/OIDC consent page allows attackers to execute arbitrary JavaScript in the victim's authenticated session, enabling session theft and administrative takeover. Affects OpenAM versions 13.0.0 through 16.1.1. No active exploitation confirmed, but the attack vector is straightforward and publicly documented.
Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at `/api/auth/setup` in `web/backend/api/auth.go` accepted POST requests without validating `Origin`, `Referer`, or `Sec-Fetch-Site` headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
CSRF in grav-plugin-login before 3.8.11 allows a remote unauthenticated attacker to rotate a logged-in victim's TOTP secret by luring them to an attacker-controlled page that performs a top-level GET navigation to the Grav site's regenerate2FASecret task endpoint. Because Grav dispatches frontend tasks via GET URI parameters and the default SameSite=Lax session cookie policy permits cross-origin top-level GET navigations to carry cookies, the victim's authenticator app is silently invalidated, forcing 2FA re-enrollment - though the attacker gains no account access. No public exploit has been identified at time of analysis; CVSS 4.0 score is 2.3, reflecting genuinely low severity.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Cross-Site Request Forgery in the Appointment Booking Plugin for WordPress (versions before 5.6.3) allows an unauthenticated attacker to perform privileged administrative actions - including overwriting the booking-form configuration and disconnecting the connected payment gateway - by tricking a logged-in administrator into clicking a malicious link or visiting an attacker-controlled page. The root cause is absent CSRF nonce validation across multiple state-changing actions handled by the plugin's central request dispatcher. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS sits at 0.10% (1st percentile), indicating negligible observed exploitation activity and no CISA KEV listing at time of analysis.
Cross-site request forgery in the Landing Page Builder - Coming Soon Page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin (all versions up to and including 1.5.3.6) allows unauthenticated remote attackers to manipulate arbitrary WordPress posts by sending a forged AJAX request that inherits an authenticated editor or administrator's browser session. Missing nonce validation on the ulpb_admin_ajax function means a victim who clicks a crafted link while logged in unknowingly authorizes post creation, modification of titles, slugs, types, status, and injection of ULPB_DATA post meta. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified; EPSS data was not provided in available intelligence.
Authenticated operator access in nebula-mesh v0.3.0-v0.3.8 allows bypassing the configured enrollment token lifetime policy: the Web UI host-creation path (POST /ui/hosts) hardcodes a 24-hour bearer token expiry in internal/web/handlers.go:879, silently ignoring both server-wide and per-network enrollment_token_ttl settings that the API sibling path (internal/api/hosts.go:190-196) correctly honors via the tokenTTLFor resolver. Enrollment tokens are bearer credentials for the public POST /api/v1/enroll endpoint; a token with a longer-than-intended TTL widens the window in which a copied, logged, or leaked token can enroll a pending Nebula host and retrieve its signed certificate and configuration. Publicly available exploit code (a reproducible Go unit test) confirms the bypass on v0.3.8; no public exploit identified at time of analysis beyond this PoC; a vendor-released patch exists in v0.5.0.
Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `'` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.
Cross-site request forgery in Kimai's timesheet API allows an unauthenticated attacker to trigger unauthorized state changes against any logged-in victim by embedding malicious GET requests in attacker-controlled pages. Kimai versions up to and including 2.57.0 expose the `stop` and `restart` timesheet operations as HTTP GET routes, which browsers will follow automatically using the victim's active session cookie - no CSRF token is required. Impact is limited to timesheet data integrity and availability (corrupted time records, unauthorized entries, billing distortion), not system compromise; no public exploit is confirmed at time of analysis, and no active exploitation has been reported by CISA KEV.
CSRF vulnerabilities in Kimai 2.56.0 through 2.57.0 allow an unauthenticated attacker to manipulate the authorization topology of the time-tracking application by tricking a privileged logged-in user into visiting a malicious page. The three affected GET endpoints - for projects, customers, and activities - perform persistent writes: creating or reusing a Team, assigning the victim as teamlead, and binding the target object to that team. No public exploit is currently available at time of analysis, though a PoC was submitted to the vendor and subsequently removed; the fix (moving routes to POST endpoints) shipped in version 2.58.0.
HedgeDoc's GitHub Gist export feature exposes private and protected note content to attacker-controlled GitHub accounts via OAuth2 state parameter forgery. Versions prior to 1.11.0 generated an OAuth2 state token during the Gist export flow but validated only its presence - not its binding to the initiating user session - enabling a cross-site request forgery attack. An attacker who tricks a logged-in victim into clicking a crafted callback URL can redirect the victim's note export to the attacker's own GitHub Gist, bypassing any note visibility controls. No public exploit code or CISA KEV listing is identified at time of analysis, but a confirmed patch exists in version 1.11.0.
Stored XSS in Laravel-Mediable before 7.0.0 allows network-accessible, unauthenticated attackers to persist malicious JavaScript payloads by uploading crafted SVG files containing embedded scripts in onload handlers, script tags, or foreignObject elements. When any authenticated user subsequently opens or previews a poisoned file in their browser, the payload executes with full DOM access, enabling session cookie theft, CSRF token capture, and complete account takeover. No public exploit has been identified at time of analysis, but the attack requires no special privileges and the technique is well-understood; the vendor has classified this as a security release and strongly recommends immediate upgrade to 7.0.0.
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP GET requests while exempting GET from its anti-CSRF header validation, enabling two distinct attack paths: a classic CSRF attack requiring a logged-in administrator to visit a crafted URL, and a fully unauthenticated path exploitable from localhost against default installations. Successful exploitation allows account creation, configuration modification, and ultimately remote code execution on the HFS host. Patch version 3.2.1 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery in the Drupal Ray Enterprise Translation contrib module lets a remote attacker forge state-changing requests that are executed with the privileges of an authenticated victim (typically a site administrator), potentially altering translation configuration and integrations. It affects module versions below 4.0.4, below 4.1.4, and below 11.0.4, and carries a vendor CVSS of 8.8. No public exploit has been identified at time of analysis and the EPSS score is very low (0.12%, 2nd percentile), indicating no observed exploitation activity.
Cross-Site Request Forgery in the Drupal Salesforce Suite contrib module (all versions from 0.0.0 up to and including 5.1.3) lets an attacker forge state-changing requests that are executed with the privileges of an authenticated Drupal user who is tricked into loading attacker-controlled content. The Drupal security team (SA-CONTRIB-2026-063) rates it critical, and a fixed release is available; no public exploit code has been identified and EPSS is very low (0.10%, 1st percentile), indicating no observed exploitation activity. Note that the published CVSS vector (UI:N) is atypical for CSRF, which normally depends on victim interaction, so the real-world impact profile should be verified against the vendor advisory.
Cross-Site Request Forgery in the GoodMeet WordPress plugin (versions up to and including 1.1.8) enables unauthenticated remote attackers to wipe a site's stored Google Meet API credentials and OAuth tokens by deceiving a logged-in administrator into triggering a crafted request. The vulnerable reset_credential() function handling the wp_ajax_goodmeet_reset_google_meet_credential AJAX action checks the manage_options capability but omits mandatory WordPress nonce validation, allowing any cross-origin request to be processed as legitimate. The practical outcome is complete disabling of the site's Google Meet integration with no data disclosure; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in YesWiki's Bazar form module allows a privileged form editor to inject persistent script payloads into field label and hint fields, which execute in the browser context of every subsequent visitor - including unauthenticated guests - who renders an affected form. The vulnerability is a sibling class of an incomplete fix at commit e6b66aa: that commit removed the dangerous |raw('html') filter from two Twig template call sites but left eleven additional sites in range.twig, email.twig, layouts/input.twig, layouts/field.twig, textarea.twig, user.twig, bookmarklet.twig, subscribe.twig, and linked-entry.twig still suppressing Twig's HTML auto-escaping. No active exploitation is confirmed in CISA KEV, but a detailed proof-of-concept with exact payloads, rendered HTML output, and affected line numbers is included in GitHub Security Advisory GHSA-xc7j-3g8q-9vh4, and patch commit 5d1a4d07 is publicly available.
Cross-site request forgery in Admidio's plugin management endpoint (`modules/plugins.php`) enables a remote attacker to trigger destructive plugin operations - including irreversible DROP TABLE SQL execution - against any authenticated administrator who visits an attacker-controlled web page. The endpoint processes install, uninstall, and update operations via unauthenticated GET requests lacking CSRF token validation, and SameSite=Lax cookie behavior causes browsers to automatically include session credentials on top-level GET navigations from cross-origin pages. A working Playwright-based proof-of-concept is publicly available demonstrating the full attack chain; no confirmed active exploitation (CISA KEV) is present at time of analysis.
Cross-Site Request Forgery in HP IP phones' web management interface allows an attacker who has obtained a stolen session cookie to submit unauthorized state-changing requests that modify the phone's webpage contents, with integrity and availability rated high (VI:H/VA:H) in the vendor-supplied CVSS 4.0 vector. The CVSS 4.0 score of 6.0 reflects the attack conditions prerequisite (AT:P) of prior cookie theft, low-level privilege requirement (PR:L), and passive user interaction (UI:P), meaningfully limiting opportunistic exploitation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Cross-Site Request Forgery in Waku's RSC request dispatcher allows a remote attacker to invoke any state-mutating 'use server' server action with a victim's session cookies by exploiting the complete absence of Origin header validation in the core request handler at packages/waku/src/lib/utils/request.ts. Both the RSC path prefix branch (exploitable via Content-Type: text/plain, no preflight) and the progressive-enhancement HTML form branch (exploitable via multipart/form-data) are unguarded, with opaque-origin contexts such as sandboxed iframes and browser extension pages additionally exploitable via Origin: null. The reporter confirmed a working proof-of-concept against waku 1.0.0-beta.0 with dynamic verification on 2026-05-17; all HTTP adapters share the same vulnerable dispatcher and no patched version has been identified at time of analysis.
Cross-site request forgery in Flask-MonitoringDashboard up to version 5.0.2 allows a remote unauthenticated attacker to trick an authenticated dashboard user into submitting malicious state-changing requests by luring them to a crafted page. The vulnerability (CWE-352) is limited in scope to the monitoring dashboard itself with a low integrity impact and no confidentiality or availability consequence, reflected in the CVSS 4.0 score of 2.1. Exploit details have been publicly disclosed via VulDB submissions and a GitHub issue report, but no patch has been released and the project maintainer has not yet responded to the responsible disclosure.
Cross-Site Request Forgery in Smash Balloon Social Photo Feed - Easy Social Feeds Plugin for WordPress (all versions through 6.11.1) enables unauthenticated remote attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by forging a request that a logged-in administrator unwittingly executes. The root cause is missing or incorrect nonce validation on the `maybe_connection_data` function, WordPress's primary CSRF defense mechanism. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch changeset is confirmed in the WordPress plugin repository.
Cross-Site Request Forgery in the Wp Js Detect WordPress plugin (all versions ≤ 1.0.9) permits unauthenticated attackers to overwrite the plugin's frontend notification text and CSS settings by exploiting absent nonce validation in the plugin_settings function. Because the stored values are echoed unescaped to the WordPress frontend, a successful forged request can inject arbitrary HTML or script content visible to site visitors who have JavaScript disabled. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; EPSS data was not supplied.
Cross-site request forgery in new-api's OAuth account binding endpoints allows an unauthenticated network attacker to silently rebind a logged-in user's email or WeChat identity to attacker-controlled credentials by luring the victim to a malicious page. Affected are all deployments running versions prior to v0.12.0-alpha.1 where the GET-based bind endpoints are reachable. No public exploit has been identified at time of analysis, and the default SameSite=Strict cookie configuration substantially limits real-world exploitability to environments that have weakened or overridden that default.
Cross-site request forgery in SEIKO EPSON Web Config allows a remote, unauthenticated attacker to trigger unintended configuration changes on Epson network devices by luring an authenticated administrator into visiting a malicious web page. The vulnerability (CWE-352) requires no privileges on the attacker's side but depends on an active, authenticated Web Config session on the victim's browser. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in imhamzaazam ecommerceFlask allows a remote, unauthenticated attacker to induce authenticated victims into executing unauthorized state-changing actions against the application. The vulnerability exists in an unspecified function of the Flask-based e-commerce application up to commit cb7d9e24c30a99379651b7493b32048126ef402b, with no patch released and the project maintainer not yet responding. A publicly available proof-of-concept exploit has been disclosed via a GitHub issue, and the application's rolling release model means no fixed version can be identified.
Cross-Site Request Forgery in the CrawlWP SEO WordPress plugin (versions through 3.0.16) allows an unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated site administrator. Exploitation requires social engineering - a logged-in admin must be tricked into visiting a malicious page that silently submits a forged request. The integrity impact is low, limited to unauthorized configuration changes within the plugin's functionality. No public exploit code or active exploitation has been identified at time of analysis, consistent with the vulnerability's low CVSS base score of 4.3.
Cross-site request forgery in webpack-dev-server 5.2.5 and earlier allows any website visited by a developer to silently invoke two unauthenticated state-changing endpoints - `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` - via simple browser-initiated GET requests that carry no CSRF protection. An attacker controlling a web page visited during an active dev session can open arbitrary local files in the developer's editor (including files outside the project root) and trigger repeated forced recompilations that degrade workstation performance. No public exploit has been identified at time of analysis, and exploitation is confined to developer workstations rather than production infrastructure.
Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-impacting actions against authenticated WordPress users without their consent. The CVSS vector (C:N/I:N/A:H) indicates this CSRF leads to a destructive availability outcome - likely deletion or corruption of booking/scheduling data - rather than data theft or code execution. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and no required privileges for staging the attack make social-engineering delivery straightforward.
Cross-Site Request Forgery in the Werkstatt WordPress theme (FuelThemes) version 4.7.2 and earlier allows remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated WordPress users. The flaw stems from missing or inadequate CSRF token validation on one or more theme action endpoints, meaning a crafted web page or link can silently trigger privileged operations when visited by a logged-in user. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-Site Request Forgery in GiveWP - Donation Plugin and Fundraising Platform (versions up to and including 4.15.3) allows unauthenticated remote attackers to disable donation email notifications by tricking a logged-in administrator into clicking a crafted link. The root cause is absent nonce validation in the give_set_notification_status_handler() AJAX handler, permitting forged state-changing requests. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, the integrity impact - silently disabling donation notifications - could cause operational blind spots for nonprofit or fundraising site operators.
Cross-site request forgery in the Wikimedia Foundation's MediaWiki RedirectManager Extension (all versions before 1.3.3) enables remote attackers to perform unauthorized redirect management actions on behalf of authenticated wiki users. The CVSS 4.0 base score of 6.9 (Medium) reflects network-accessible exploitation with low impact across confidentiality, integrity, and availability dimensions on both vulnerable and subsequent systems. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Cross-origin data leakage in Google Chrome's SVG implementation prior to version 150.0.7871.47 allows a remote attacker to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw exploits improper SVG handling that bypasses same-origin policy protections, exposing potentially sensitive session data or authenticated content from third-party origins. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS stands at 0.17% (7th percentile), indicating low observed exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's DevTools component (versions prior to 150.0.7871.47) permits a remote attacker to exfiltrate data across origin boundaries by tricking a user into performing specific UI gestures on a crafted HTML page. The CVSS base score of 3.1 (Low) reflects high attack complexity and mandatory user interaction, consistent with the EPSS score of 0.21% (11th percentile) indicating negligible in-the-wild exploitation activity. No public exploit code is identified and no CISA KEV listing exists; a vendor patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.