Cross-Site Request Forgery

CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.

Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.

Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.

WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.

Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.

FrontAccounting 2.4.20 and earlier selectively enforces CSRF validation - tokens are generated for every rendered form but the validation call is absent from all financial transaction handlers, including journal entries, supplier invoices, customer payments, bank transactions, and company configuration. An attacker who can induce an authenticated FrontAccounting user to visit a malicious page can silently forge any of those POST requests under the victim's live session, recording fraudulent accounting data without the victim's awareness. No public exploit identified at time of analysis, though a detailed researcher disclosure with technical specifics is publicly available on GitHub.

Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.

Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.

UpdraftPlus: WP Backup & Migration Plugin for WordPress (all versions before 1.26.7) exposes a backup restoration action without CSRF token validation, enabling a remote attacker to revert a site's entire database and files to a prior backup state by tricking a logged-in administrator into clicking a crafted link. The integrity impact is high - a successful exploit silently undoes content updates, security hardening, and user data accumulated since the backup was taken. No public exploit is identified at time of analysis; EPSS sits at the 1st percentile and SSVC marks exploitation as none, indicating low current threat activity.

Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute arbitrary Nagios commands on behalf of an authenticated user by exploiting a bypass in the double-submit cookie CSRF protection implemented in cmd.cgi. When the Cookie header is absent in a POST request, the server's CSRF check can be satisfied simply by supplying matching NagFormId and nagFormId values in the POST body - a condition entirely within the attacker's control. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the technique is well-understood and the bypass mechanism is straightforward to reproduce.

Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring commands by tricking an authenticated administrator into visiting a malicious page. The flaw in cmd.cgi stems from a logic inversion: the CSRF protection mechanism treats an absent NagFormId cookie as a passing check rather than a failing one, rendering the protection entirely ineffective. The CVSS 4.0 vector (VI:H, UI:A) confirms real integrity risk - an attacker can issue commands under a victim session - though user interaction is required and no public exploit or CISA KEV listing exists at time of analysis.

Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.

Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.

Account takeover in self-hosted Typebot up to and including 3.17.1 lets an anonymous attacker who knows a victim's email hijack their session via brute force of the passwordless email magic-link login code. The email provider replaces NextAuth's secure token with a 6-digit Math.random() code (900,000-value keyspace, 10-minute validity) that is placed raw in the link, while the verification callback enforces no attempt cap, lockout, or CSRF protection and does not invalidate the real code on wrong guesses. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed in 3.18.0.

Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.

Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.

Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.

Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.

Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.

Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.

Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.

Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.

Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.

CSRF protection is absent on front-end state-changing operations in YOOtheme's Zoo Joomla extension before version 4.1.66, enabling an attacker to forge requests that alter application state on behalf of a high-privileged authenticated user. Exploitation requires luring a logged-in administrator or privileged Zoo user to interact with a malicious page while their session is active. The integrity impact is limited to the vulnerable system, and no public exploit code or active exploitation has been identified at time of analysis.

CSRF in the LitExtension WordPress migration plugin (≤1.2.5) allows an unauthenticated remote attacker to overwrite the store-migration connector's authentication token by tricking a logged-in administrator into clicking a crafted link. Token replacement gives the attacker control over the connector, potentially enabling unauthorized access to migrated store data or disruption of active migration workflows. A publicly available proof-of-concept exploit was published via WPScan; this vulnerability has not been added to the CISA KEV catalog at time of analysis.

Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.

Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.

Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.

CSRF vulnerabilities in Frappe Framework's OAuth2 consent flow allow network-accessible attackers to trick authenticated users into unknowingly approving OAuth grants or to reuse authorization state across unintended clients, exposing user data and permitting actions within granted scopes. Three weaknesses combine: the consent approval endpoint accepted GET requests, the consent template lacked CSRF token protection, and active OAuth token lookups were not scoped to the requesting client_id. Versions prior to 15.114.0 and 16.x prior to 16.26.0 are affected; vendor-released patches are available and no public exploit has been identified at time of analysis.

Cross-Site Request Forgery in Frappe Framework 16.31.0 and earlier allows an unauthenticated attacker to forge workflow approval actions on behalf of any authenticated victim user, because the bulk_workflow_approval endpoint in frappe/model/workflow.py accepts state-mutating requests via safe HTTP methods (GET) in addition to POST. The attacker needs only to lure an authenticated user to a crafted page or link, causing their browser to silently submit an approval with the victim's session credentials. No released patched version is available at time of analysis; the upstream fix exists only as an unmerged PR and commit.

Cross-Site Request Forgery in ATutor 2.2.4 allows a network-based attacker to modify authenticated users' profile fields by tricking them into visiting a malicious webpage that submits a forged profile-update request. The application lacks CSRF token validation on the profile update endpoint, so the server cannot distinguish forged requests from legitimate ones. No patch exists or will be released, as ATutor is end-of-life; no public exploit code or active exploitation has been identified at time of analysis.

Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352).

CSRF in the Frauscher FDS 102 web interface (versions 2.0.0 through 2.13.3) allows a low-privileged remote attacker to coerce authenticated users into executing unintended actions by directing them to a crafted malicious web page. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact against the vulnerable system, driven by the absence of complexity requirements and the low privilege bar for the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, though the industrial railway context of this product elevates operational risk if exploited.

Cross-site request forgery in the TinaCMS CLI dev server allows an attacker-controlled web page to write arbitrary files into a developer's local media root without their knowledge. The Vite dev server's CORS middleware only suppressed response headers for disallowed origins but never terminated the underlying request, and because multipart/form-data is a browser 'simple request' exempt from CORS preflight, an attacker page can silently drive a complete media upload to completion. Exploitation requires the targeted developer to visit an attacker-controlled page while tinacms dev is running locally; no public exploit identified at time of analysis, though a researcher-validated proof-of-concept is documented in GHSA-rgr9-r7mj-mf6x. Vendor-released patch: @tinacms/cli@2.5.2.

Dashboard Studio workflow actions in Splunk Enterprise can be weaponized by a 'power'-role user to store attacker-controlled SPL that executes under a victim's permission context when triggered via Event Actions. Affected versions span all major branches: 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation enables unauthorized read and write access to data within the victim's Splunk permission scope.

Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands as the web-server user by exploiting a three-weakness chain in the terminal endpoint: an authentication bypass triggered by supplying a password parameter, a CSRF skip triggered by any non-empty csrf value, and unsanitized command passthrough directly into PHP's proc_open(). The attack requires a single crafted HTTP POST request and no prior credentials. A public proof-of-concept appears available via a GitHub Gist reference in the VulnCheck advisory. No active exploitation is confirmed by CISA KEV at the time of this analysis.

Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.

Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.

Cross-site request forgery in OpenEMR's DICOM viewer (versions before 8.3.0) allows an unauthenticated attacker to force an authenticated user holding 'Patients - Documents' permissions to issue arbitrary state-changing requests to OpenEMR endpoints, including forced logout. The unsanitized reflection of the `web_path` GET parameter in `library/dicom_frame.php` is the root mechanism: a crafted URL delivers the malicious payload via the victim's own authenticated session. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com) allows attackers to trick authenticated users into performing unauthorized state-changing actions across a broad set of unprotected endpoints. Missing CSRF tokens span both frontend operations - contact forms, cart, bookmarks, file uploads, messages, and AI text generation - and sensitive administrator actions including demo-data wipe, app install, cache archiving, and mobile push notification dispatch. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.6 reflects mandatory victim interaction and the requirement for an authenticated session.

Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. Rated CVSS 4.0 10.0 (critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Pre-authentication PHP code injection in Balbooa Forms, a commercial Joomla form-builder extension, in all versions before 2.4.3.2 lets a remote unauthenticated attacker run arbitrary server-side code. The flaw stems from the optional custom-PHP post-submission handler being executed through eval() after the [URL parameter = X] shortcode is replaced with the raw, unescaped value of an attacker-controlled query parameter. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the combination of unauthenticated network reach and full remote code execution makes this a maximum-severity issue wherever a matching handler is configured.

Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. No public exploit has been identified at time of analysis, but the attack requires zero prerequisites beyond a published payment-enabled form.

Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.

Cross-site request forgery in HashBar - WordPress Notification Bar plugin through version 2.0.0 allows a remote unauthenticated attacker to perform unauthorized administrative actions by tricking a logged-in WordPress administrator into visiting a crafted webpage. Reported by Patchstack (audit@patchstack.com) and registered as EUVD-2026-62209, this flaw carries a CVSS 8.8 score reflecting high C/I/A impact ratings, though the realistic blast radius depends on which admin-facing functions the plugin exposes to forged requests. No public exploit or CISA KEV listing has been identified at time of analysis.

Header spoofing in fastify 5.8.3 through 5.12.0 persists despite the prior CVE-2026-3635 patch because the numeric trustProxy form compiles to a hop-count predicate that structurally ignores the connecting address, rendering the guard introduced by the earlier fix completely ineffective for this configuration. An attacker who can reach the Fastify origin server directly - bypassing the front-facing reverse proxy - can forge X-Forwarded-For, X-Forwarded-Host, and related fields that fastify uses to derive request.ip, request.hostname, request.host, and request.protocol, enabling host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin spoofing, and host-based routing and cache poisoning. No public exploit has been identified at time of analysis; the vendor-released fix is fastify 5.12.1, which disables the numeric trustProxy form entirely.

Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.

Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.

Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. No public exploit has been identified at time of analysis, but the attack path is technically straightforward and targets a routine administrative workflow that reliably delivers the payload.

Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.

Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.

CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.

Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.

Cross-site request forgery in SourceCodester Online Examination & Learning Management System 1.0 enables remote attackers to perform unauthorized state-changing actions on behalf of authenticated users by tricking them into visiting a crafted page or clicking a malicious link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L) confirms the attack is network-initiated without attacker authentication, though victim interaction is required and impact is limited to partial integrity loss within the vulnerable system. No public exploit code or CISA KEV listing exists at time of analysis.

Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).

GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page.

Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.

Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.

Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.

Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.

SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.

Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.

Session theft and unauthorized OAuth consent grant in OpenAM Community Edition through 16.0.6 result from the default configuration issuing the iPlanetDirectoryPro SSO cookie with HttpOnly=false and simultaneously reusing that cookie as the CSRF token in OAuth/OIDC consent flows. An authenticated console user who clicks a single attacker-crafted link, when chained with any co-resident same-origin XSS on the OpenAM origin, loses their SSO session and simultaneously completes an attacker-driven OAuth consent grant in one interaction. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the dual-purpose misuse of the session cookie - as both a bearer token and a CSRF guard - substantially amplifies the impact of any XSS present in the same origin.

Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.

Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.

Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.

Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.

Cross-site request forgery in Budibase's AI chat-link handoff endpoint (GET/POST /api/chat-links/:instance/:token/handoff) permits a same-tenant attacker with low privileges to permanently bind their external chat identity (Slack, Discord, MS Teams, or Telegram) to any authenticated victim user's Budibase account. Because the confirmation token is rendered in plaintext inside the HTML page the victim views and the POST endpoint carries no CSRF protection or session binding, an attacker can extract the token from their own session initiation flow and embed it in a phishing page that auto-submits on load, hijacking the victim's globalUserId mapping. Once bound, the attacker impersonates the victim across all AI agent operations and inherits the victim's workspace permissions on knowledge sources and downstream automations. No public exploit code or KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 8.7 reflects high confidentiality and integrity impact across both the vulnerable system and subsequent downstream systems.

Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283569.

Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory https://www.ibm.com/support/pages/node/7283486.

Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.

Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.

Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.

Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.

Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.

JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.

Cross-site request forgery in the ShopEngine Elementor WooCommerce Builder Addon for WordPress (versions before 4.9.3) enables an unauthenticated remote attacker to silently authenticate a victim into an attacker-controlled WordPress account by tricking the victim into visiting a malicious page. When the victim subsequently proceeds to WooCommerce checkout, all billing and shipping details they enter are stored under and readable by the attacker, exposing personally identifiable information. No active exploitation is confirmed (not listed in CISA KEV), the EPSS score is 0.11% (2nd percentile) indicating very low current exploitation probability, and a vendor-released patch is available in version 4.9.3.

Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.

Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.

Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.

Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.

Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.

Insufficient input validation on the `_handler` POST field in Winter CMS's form postback mechanism allows any authenticated backend user to invoke arbitrary controller methods-including protected and private ones-bypassing role-based permission checks. The Users controller compounded this by conditionally nullifying its `$requiredPermissions` for the `myaccount` action, enabling low-privilege backend users to call administrative methods such as `update_onDelete`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` against any backend user record. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is limited to users with active, authenticated backend sessions (CSRF tokens remain enforced).

Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.