Cross-Site Request Forgery

Session hijacking via cross-site request forgery affects OpenHuman versions before 0.56.0: the unauthenticated loopback callback GET /auth/telegram accepts an attacker-supplied one-time Telegram login token and writes the returned JWT straight into the victim's local session store, switching the victim's active session to the attacker's backend account (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1 High). Because the malicious request is issued by the victim's own browser to 127.0.0.1:7788, the attacker needs only their own OpenHuman account, a valid one-time Telegram token, and a victim who visits a crafted page while their local core is running - no authentication to the victim host is required. Exploitation leaves subsequent agent actions, memory writes, and Telegram messages flowing into the attacker's account; no public exploit code or confirmed active exploitation was identified at time of analysis.

Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).

Cross-site request forgery in the aThemeArt Theme Helper WordPress plugin (all versions up to and including 1.0.8) allows a remote attacker with no credentials of their own (CVSS:3.1/AV:N/AC:L/PR:N) to induce a logged-in privileged WordPress user - typically an administrator - to submit a forged request to the site, causing state-changing plugin actions to execute with the victim's authority. The flaw is a missing CSRF token check (CWE-352); the forged action is limited to operations the plugin exposes without nonce validation, and exploitation hinges on the victim having an active authenticated session and being tricked into interacting with attacker-supplied content (UI:R). A Patchstack advisory is the only public reference, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Note that the supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) is more severe than our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), which reflects that impact is bounded by the victim's privilege level and by which nonce-less plugin endpoints exist.

Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).

Cross-site request forgery in XXL-JOB 3.5.0-SNAPSHOT and earlier lets an attacker riding an authenticated administrator's browser session create, modify, or delete console user accounts through the unprotected /user/insert, /user/update, and /user/delete endpoints in JobUserController. The flaw is scored CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no attacker privileges are required, but success depends entirely on a logged-in admin being lured into visiting an attacker-controlled page, since the endpoints carry no anti-CSRF token and do not restrict HTTP method. No public exploit code and no CISA KEV entry were identified at time of analysis, and the practical impact is limited to user-management state (account creation, privilege changes, and deletion) on admin consoles that are reachable from the victim's browser.

Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.

Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.

Qexo instances running versions 4.0.0 through any release before 4.2.0 expose the /api/init_step/ initialization endpoint without authentication or a setup-completion guard, allowing an unauthenticated attacker who supplies a CSRF token harvested from any public page of the instance to restart the setup flow and, in the same interaction, read back stored PROVIDER configuration such as service credentials. The CNA rates this 9.3 (Critical, CVSS 4.0) while our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the integrity impact is a forced re-entry into initialization rather than arbitrary data modification, and that the confidentiality loss only materializes on instances that have already stored provider secrets (for example a Vercel token or image-bed credentials). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Qexo 4.2.0.

Cross-site request forgery in ConvertX versions prior to 0.18.0 lets an attacker permanently delete an authenticated user's conversion jobs by luring that user into loading attacker-controlled content that silently requests /delete/{id} over HTTP GET. Because the deletion route performs a state-changing action without a CSRF token and job identifiers are simple sequential integers, an <img> or <iframe> src pointing at a guessed id is enough to trigger deletion with the victim's session cookie attached, with no click required. Exploitation requires an active victim session and the victim viewing attacker-controlled content; impact is confined to the victim's own job history (the provider scores this 8.1 with I:H/A:H, while our assessment rates the impact as limited, I:L/A:L), no public exploit code has been identified, and CISA KEV does not list this issue. The flaw is fixed in version 0.18.0, which converts the endpoint to POST and switches the UI to form-based submission.

Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.

Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.

Progress MarkLogic Server deployments in the 12.x line before 12.1.0 and the 11.x line before 11.3.7 generate predictable anti-CSRF tokens for Query Console, allowing a remote attacker to forge requests that pass CSRF validation and execute server-side code with the permissions of a logged-in victim. Exploitation is conditional: the attacker must lure a user who currently holds a live authenticated Query Console session to an attacker-controlled page, so user interaction is mandatory and unattended servers or logged-out users are not reachable this way. A vendor advisory is available (community.progress.com MarkLogic Critical Security Alert Bulletin, October 2026) and confirmed fixed versions exist; there is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied, so this is best treated as a credible but conditional risk rather than a drop-everything emergency.

Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.

Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.

Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.

Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.

Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.

Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.

Cross-site request forgery in OpenRefine through 3.10.1 lets a remote attacker run operating system commands as the OpenRefine user by luring that user's browser into issuing a crafted cross-origin GET to the local get-rows command with a malicious engine parameter that evaluates a Jython facet expression. Exploitation is not drive-by: it requires the victim to have OpenRefine running with a project loaded and an active session and to be induced into visiting an attacker-controlled page, and it depends on the target build bundling the Jython extension that provides the expression-evaluation path. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high attack complexity and mandatory user interaction offsetting the full confidentiality, integrity and availability impact on the OpenRefine host.

Cross-site request forgery in Nginx UI versions 2.0.0 through 2.4.x lets a remote attacker drive a logged-in administrator's browser into performing authenticated, state-changing management operations - including rewriting Nginx configuration through POST /api/configs, triggering config reloads, and invoking other admin endpoints - because the AuthRequired middleware accepts the browser-managed JWT cookie as a valid API credential while management routes generally enforce neither a CSRF token nor Origin/Referer validation. Exploitation requires the victim to be a currently logged-in administrator who is induced to visit an attacker-controlled page (UI:R); per the CVSS vector the attacker needs no credentials of their own (PR:N), but a targeted account protected by OTP/Passkey step-up, or an endpoint requiring secure-session proof, is not exploitable. The attacker cannot read cross-origin responses, so impact is blind configuration tampering and service disruption rather than data exfiltration; the issue is fixed in 2.5.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.

Attackers can forge state-changing requests in the Featured Image from URL WordPress plugin through 6.0.7, allowing them to cause an authenticated administrator to perform unintended actions, but only if the administrator interacts with attacker-controlled content (UI:R). The input CVSS of 8.8 overstates impact; independent assessment rates confidentiality and integrity as Low and availability as None. No public exploit code identified at time of analysis; consult the Patchstack advisory for remediation.

Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) lets a remote attacker who lures a logged-in user into loading attacker-controlled content submit unauthorized, privileged state-changing requests through that victim's authenticated session; CVSS 3.1 rates it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no credentials of their own, but successful abuse depends on a concurrently authenticated victim - most damagingly an administrator - plus a social-engineering/user-interaction step, so exposure is greatest where the management interface is internet-reachable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a vendor patch is available per IBM's advisory.

Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the operator into loading attacker-controlled web content force that operator's browser to fire unauthenticated management commands at the kiosk's POST /script_call/<script> endpoint. Successful abuse yields high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N), because the reachable commands are destructive rather than data-stealing - most notably control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which blinds security monitoring. The endpoint ships with zero authentication and wildcard CORS (CORS(app)) in its default state, so no server-side misconfiguration is required; the only real barrier is inducing the specific operator to render a malicious page (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis.

Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while `Agent.to_web()` or `clai web` is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch `/api/chat` endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. Realized damage is bounded by the tools the agent exposes, and `requires_approval=True` does not help because the endpoint trusts approval decisions relayed by the client; exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, 7.6) but requires the developer to browse an attacker-controlled page while the dev UI is running, and there is no public exploit code identified at time of analysis. Vendor-released patches are available in 1.107.4 and 2.28.0.

Cross-site request forgery in the WPMU DEV Forminator WordPress plugin, affecting all versions through 1.57.3, lets an unauthenticated attacker craft a malicious page that, when visited by a logged-in site administrator, silently submits state-changing requests to the vulnerable site on that administrator's behalf. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N), reflecting high integrity impact offset by the required victim interaction and no availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied. Risk is bounded by the interaction requirement: the attack fails if the targeted privileged user is not currently authenticated in a browser session while visiting the attacker-controlled page.

Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).

Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.

Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.

Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows remote attackers to force a logged-in user, typically an administrator, to perform unintended actions by tricking them into interacting with a crafted link or malicious page, due to missing CSRF token validation. Exploitation requires user interaction (UI:R) and an active authenticated session, but no public exploit code is currently identified. The vulnerability has a CVSS score of 7.1 (moderate severity per independent assessment) and is tracked as CWE-352.

Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.

Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.

Cross-site request forgery in YesWiki before 4.6.7 allows unauthenticated attackers to permanently delete arbitrary wiki pages (including their ACLs, links, triples, comments, and referrers) by luring a logged-in administrator or page owner to a crafted URL that invokes the ajaxdeletepage handler with a jsonp_callback parameter. The vulnerability requires user interaction (UI:P) and a privileged victim session, and it has no public exploit identified at time of analysis, though a vendor patch is available.

Cross-site request forgery in YesWiki before 4.6.7 lets an attacker delete installed packages from a wiki instance by luring a logged-in administrator to a crafted link. The autoupdate UpdateAction processes state-changing deletions through unprotected GET requests - accepting action=delete together with a package parameter - with no anti-CSRF token check, so a request issued from an attacker-controlled page is executed with the administrator's session privileges. Deleting packages such as bazar strips functionality the site depends on, breaking core operation (CVSS 4.0 base 7.1; high availability impact, low integrity impact, no confidentiality impact). Exploitation is context-dependent: it requires a live administrator session in the victim's browser plus a lure/click, and no public exploit code has been identified at time of analysis.

Stored cross-site scripting in the MW WP Form plugin for WordPress (all versions up to and including 5.1.7) lets an unauthenticated visitor persist arbitrary JavaScript into a site by submitting a crafted 'post_id' value to a public form. The plugin's CSRF gate (MW_WP_Form_Csrf) is a double-submit cookie check that any visitor can satisfy simply by loading the public form page first, so there is no meaningful barrier to storing the payload; the script then executes whenever a victim - potentially an administrator - later views the injected page. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N by the reporter; assessed as UI:R by our team), this is a genuine but moderate-priority issue rather than a drop-everything emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Remote code execution in GetSimple CMS CE (Community Edition) prior to 1.5 stems from a cross-site request forgery flaw in the UpdateCE update form, which ships without an anti-CSRF token and whose POST handler performs no token or request-origin verification. A remote attacker, unauthenticated per the CVSS vector (PR:N), can host a page that auto-submits a forged POST to the update endpoint; when a logged-in administrator visits that page, the server performs an attacker-directed download-and-deploy of a malicious update package inside the administrator's session, and because the deployed content is executed (see the related ZIP-extraction advisory), the outcome is remote code execution. Exploitation is gated by the UI:R social-engineering precondition - an authenticated admin with an active session must be lured to the attacker's page - and no public exploit has been identified at time of analysis; the vendor fix is included in version 1.5.

Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.

Cross-site request forgery in the Lektor admin API lets unauthenticated remote attackers perform state-changing actions - writing arbitrary files via newattachment, deleting pages via deleterecord, wiping build output via clean/build, and triggering deployment via publish - when an operator visits a malicious web page while the admin server is running. The flaw affects Lektor 3.3.14 and 3.4.0b15 and stems from the complete absence of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting; read endpoints can additionally be reached via DNS rebinding to disclose data. No public exploit code or confirmed active exploitation was identified at time of analysis.

Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.

Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.

Stored cross-site scripting in Pandora FMS (version 777 and later) is reachable through a chained attack in the File Manager module: an attacker abuses missing CSRF protection on the file-upload endpoint to plant an SVG file containing embedded JavaScript, which then executes in the browser context of any user who renders it. Because the affected session cookie is accessible to script, successful rendering lets the attacker exfiltrate an authenticated administrator's session and effectively take over the admin account; the vendor rates this 7.4 (High) under CVSS 4.0 while an independent assessment scores it 7.4-equivalent under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no direct availability impact. The attacker needs no credentials (PR:N) but the chain requires an active administrator to be lured into triggering the forged request (UI:A) and the prerequisite condition of an unrestricted SVG upload path being present (AT:P); there is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this should be treated as a high-priority patching item rather than an emergency incident.

Cross-site request forgery in the Featured Image from URL (FIFU) WordPress plugin before 6.0.8 and the FIFU Premium plugin before 8.2.8 allows an unauthenticated attacker to make a logged-in administrator's browser execute arbitrary WordPress REST API actions, including creating a brand-new administrator account. The defect is in the plugin's REST API nonce enforcement: supplying a specially crafted URL causes the nonce check to be bypassed for the whole request, so with the victim's admin session active the REST call is accepted without a valid nonce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) the attacker needs no account on the target, but the administrator must be induced to visit an attacker-controlled page, making the attack social-engineering dependent; no public exploit code has been identified at time of analysis, and vendor patches are available.

Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Stored cross-site scripting in the WP Mobile Menu WordPress plugin (versions 2.7.4 up to but not including 2.9) lets an attacker import arbitrary plugin settings through a forged cross-site request in a logged-in administrator's session, because the settings-import routine does not correctly verify its nonce. The imported values are then rendered unescaped to every site visitor, so the injected script persists and executes for all users until the malicious setting is removed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the attacker needs no account of their own but must socially engineer a privileged, authenticated admin into loading the crafted request; there is no public exploit code identified at time of analysis, exploitation has not been observed, and patch status is vendor-released version 2.9.

Basecamp's Upright authentication library contains a login cross-site request forgery (CSRF) flaw in the static-credentials session callback implemented in app/controllers/upright/sessions_controller.rb, where the login action is not protected by an anti-CSRF token. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R, unauthenticated remote attackers can exploit it, but success depends on victim interaction - the victim must load or be redirected to an attacker-controlled page that submits the forged login request while Upright's static-credentials session flow is exposed. The practical consequence is that the victim is silently logged into the attacker's session rather than having their own account compromised, so our independent assessment rates the impact as partial (C:L/I:L/A:N) even though MITRE assigned 8.8 (C:H/I:H/A:H); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.

Cross-site request forgery in the Froxlor hosting control panel through 2.3.10 lets an unauthenticated attacker silently strip a logged-in panel user's two-factor authentication by luring them into following a crafted GET link such as /customer_index.php?page=2fa&action=delete, with no confirmation prompt, re-authentication, or CSRF token required; both the customer and admin 2FA handlers are affected. The practical impact is bounded: the attack only removes the second factor, and full account takeover additionally requires the victim's password to already be compromised, so this is a genuine but modest-severity CSRF rather than a standalone authentication bypass. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor addressed the flaw in Froxlor 2.3.12.

Stored cross-site scripting in the Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 allows an unauthenticated visitor to plant an HTML/JavaScript payload through a front-end form whose submissions are written into the user/data store; that payload is later rendered unescaped in the classic admin panel's item-detail view and executes in the administrator's browser session and origin, with access to that administrator's privileges and CSRF token. Exploitation requires a specific but realistic configuration chain: the site must route front-end form submissions into user/data, and the administrator must open the malicious entry in the classic Grav admin panel - sites running the Grav 2.0 Admin Next interface are not affected because it renders the same data through a separate, correctly escaping code path. The initial injection is unauthenticated (CVSS PR:N), while the privilege-boundary crossing needs administrator interaction (UI:R); payloads in list-type values such as checkboxes or multi-selects fire on view with no further interaction, whereas ordinary text fields fire on hover. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Data Manager 1.4.5.

Cross-site request forgery in SiYuan lets an attacker-controlled web page reach the locally bound kernel and, through the CheckAuth lock-screen pass-through branch that skips Origin validation, perform administrator-level operations with zero credentials. Successful abuse allows the attacker to terminate the kernel process (availability impact assessed as High), read workspace configuration and proxy settings, and trigger administrative actions, with exploitation requiring the victim to have the SiYuan kernel running (default loopback binding) and to open a malicious page in a browser on the same host. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in v3.8.4.

Cross-site request forgery in the MCP Server for WordPress plugin (all versions before 1.8.2) allows unauthenticated attackers to perform administrator-only actions - including creating a brand-new administrator account - by tricking a logged-in WordPress administrator into visiting a crafted page. The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when an attacker-influenceable condition is present, so the victim's admin session is abused without any credential from the attacker (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-352). Publicly available exploit code exists per WPScan, but there is no confirmation of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is a low 0.10% (1st percentile); the practical gate is that a logged-in administrator must be lured to an attacker-controlled page while the vulnerable plugin is active.

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows unauthenticated remote attackers to cause a logged-in author or administrator to perform state-changing actions under the victim's authority, because the CSRF validation filter accepts requests that omit the required salt token and instead validates against a value the server itself generated for the request. Exploitation requires social engineering the privileged user into visiting a crafted page while their session is active (UI:R); no optional feature or non-default configuration is needed, and both standard and multipart forms are affected. A vendor patch is available in Apache Roller 6.1.6 or later; no public exploit code or active exploitation has been identified at time of analysis. The impact is bounded by the victim's own permission level (owner, editor, drafter, or administrator).

Cross-site request forgery in InvoicePlane before 1.7.2 allows a remote, unauthenticated attacker to force deletion of invoice and invoice-tax records by inducing a logged-in administrator to load attacker-controlled content that invokes the Invoices::delete() or Invoices::delete_invoice_tax() routes. Those routes performed state-changing operations without requiring a POST method or validating a CSRF token, so the victim administrator's active session was sufficient to authorize the deletion (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:R - integrity high, availability low, confidentiality none). No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; despite the 7.5 base score, this is a moderate rather than high real-world priority because it requires administrator interaction and results only in removal of financial records, with the fix released in 1.7.2.

Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.

EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.

CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.

Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.

Cross-site request forgery in Google Chrome on desktop lets a remote, unauthenticated attacker achieve high confidentiality, integrity and availability impact against a victim who is persuaded to visit or interact with an attacker-controlled page (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8). Only Chrome installations older than 154.0.8037.57 are affected, and Google has shipped a stable channel fix in that build, with the issue tracked upstream as Chromium issue 511791538 and Ubuntu listed among the reporters. No public exploit code has been identified and the flaw is not in CISA KEV, but note that the official description is empty and the CWE-352 label is hard to reconcile with the full C/I/A impact claimed, so the exact triggering feature remains unconfirmed.

Stored cross-site scripting in GitHub Enterprise Server (3.17 through 3.22 series) allows an authenticated user to inject arbitrary HTML attributes through crafted Markdown that survives initial sanitization but is then re-interpreted by the rendering pipeline's quote-character rewriting step, letting the payload chain same-origin JavaScript gadgets to bypass Content Security Policy and seize control of the page DOM in a victim's browser. When a second user views the rendered content, the attacker can read content visible to that victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes, with the payload potentially propagating into any repository or organization where the victim holds write access. Exploitation requires an authenticated account and victim interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, vendor score 7.4), no public exploit code has been identified at time of analysis, and vendor-released patches exist in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.

Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.

Credentialed cross-origin reads and namespace takeover were possible against the hosted open-vsx.org registry because its CDN/edge layer reflected the requesting Origin back in Access-Control-Allow-Origin while simultaneously emitting Access-Control-Allow-Credentials: true on authenticated /user/ endpoints. A page on any origin could then issue credentialed requests in a logged-in user's browser and read the responses, exposing /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name}, /user/namespace/{name}/members and - critically - /user/csrf; with the CSRF token readable, the write-endpoint protection collapsed, and chaining /user/csrf with /user/token/create let the attacker page mint and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces. Attackers need no authentication of their own (CVSS 4.0 PR:N) and only passive victim interaction - the victim must be logged in to open-vsx.org and visit the attacker's page - while no public exploit code has been identified at time of analysis.

CMSimple 5.24 ships with CSRF protection disabled by default, so an unauthenticated attacker can forge a content-save request that a currently logged-in administrator's browser submits (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), storing a text payload containing a scripting marker verbatim in content/content.php. Because evaluate_cmsimple_scripting() in functions.php subsequently runs that marker through PHP eval() on every page view, the result is persistent remote code execution on the web server for all visitors, including unauthenticated ones. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (26th percentile), and realistic risk is limited by the requirement to socially engineer a privileged, actively-authenticated administrator who holds a valid session cookie.

Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.

OS command injection in ntopng prior to 6.7.260717 allows an authenticated non-administrator user to run arbitrary operating-system commands as the ntopng process account, because the vulnerability-scan REST endpoints accepted the scan_ports parameter without an administrator check and passed it through a validator that still permits shell metacharacters. Exploitation requires nmap to be present on the host, and a secondary no-credentials path exists: the affected endpoints accept GET requests while ntopng's CSRF validation only covers POST bodies, so a logged-in victim's browser can be induced to trigger the command. The vulnerability is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the issue is fixed in 6.7.260717.

Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. unauthenticated from the attacker's perspective), but the forged request executes with the victim's session and is bounded by that victim's own edit permissions on the target attribute. Impact is integrity-only - no data disclosure or service disruption - rated 7.1 under both the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VI:H) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); a vendor fix is available via commit dfbae33f9 and no public exploit code has been identified at time of analysis.

Cross-site request forgery in IBM Guardium Data Protection 12.2 lets a remote attacker with no credentials (CVSS vector PR:N) induce a currently authenticated user's browser into sending forged requests that bypass security restrictions and perform privileged actions in that user's context. Exploitation is not automatic: it requires the victim to be logged into the Guardium web interface (ideally as an administrator) and to be lured into loading attacker-controlled content while that session is live (UI:R), so it is best modeled as an attacker-assisted integrity abuse of an existing session rather than a self-contained compromise. IBM has acknowledged the flaw (CWE-352) and shipped a vendor fix, but no public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so exploitation is not confirmed in the wild; successful attacks can alter configuration or security settings through the victim's own authorized privileges, but the attacker cannot read responses returned to that session.

Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.

Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-exempt admin mutation views in pages/admin/views.py to store unescaped page content that then renders to every site visitor as stored cross-site scripting. The attack is unauthenticated from the attacker's side (CVSS vectors list PR:N) but requires user interaction: an authenticated editor or admin must be lured to attacker-controlled HTML while holding an active CMS session (UI:P), so this is a genuine but conditional risk rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the secondary effects are bounded - the forged mutation only persists once a privileged victim's browser has sent the request successfully.

Server-side request forgery in Vvveb CMS versions prior to 1.0.8.5 allows an authenticated admin-panel user holding editor/* permission to make the server issue HTTP or HTTPS requests to arbitrary internal addresses through the oEmbedProxy endpoint (GET /admin/index.php?module=editor/editor&action=oEmbedProxy?url=...), returning the fetched response body to the caller. Because the action is reached over GET, no CSRF token is required, so a logged-in editor can be induced to trigger the request cross-site, and the attacker can reach private, loopback, link-local, or reserved destinations - including cloud instance-metadata endpoints such as 169.254.169.254 - potentially disclosing internal service responses and associated credentials. Storefront visitors and anonymous users cannot reach the endpoint (authentication and editor-level privilege are prerequisites), and no public exploit code has been identified at time of analysis; the issue is resolved in 1.0.8.5, which validates resolved IP addresses and pins the outbound connection to the vetted address with redirects disabled.

Speakr, a self-hosted audio transcription web app, is affected before 0.8.21-alpha by a chained authentication bypass in which a bogus token supplied as a query parameter permanently disables CSRF protection for a targeted view, letting a remote, unauthenticated attacker who lures a logged-in victim to attacker-controlled content on a sibling subdomain perform state-changing actions as that victim - editing profile data, custom prompts, transcription settings and preferences, toggling administrative status through admin_toggle_admin, and, for SSO-only accounts, silently setting a local password that bypasses SSO. No valid token or credentials are needed because the token check trusts any present token without hashing or database validation, but exploitation is conditional: it requires a victim with an active session, mandatory user interaction, a sibling-subdomain foothold, and a domain-scoped session cookie, which is why the independent assessment rates it as moderate-but-conditional risk under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N. There is no public exploit identified at time of analysis; the vendor has released a fix in 0.8.21-alpha.

Cross-site request forgery in the Xagio SEO WordPress plugin (all versions up to and including 7.1.0.43) allows an unauthenticated attacker to make a logged-in user's browser submit a state-changing plugin request without a valid nonce or CSRF token. Because the request rides the victim's existing session, the practical impact is highest when the tricked user is a WordPress administrator, though our independent assessment bounds the effect to integrity-only, limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) rather than the 8.8 high-integrity/high-availability score in the CVE record. No public exploit identified at time of analysis, and no EPSS score was supplied with the source data; the vulnerability was reported by Patchstack and tracked as EUVD-2026-81519.

Cross-site request forgery in the WordPress plugin Asset CleanUp: Page Speed Booster (versions up to and including 1.4.0.5) lets a remote attacker forge requests that a logged-in privileged user, typically an administrator working in the plugin's settings, unknowingly submits to the site. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) the attacker needs no credentials of their own, but a successful attack depends entirely on socially engineering an existing authenticated victim into visiting an attacker-controlled page while their WordPress session is active; there is no authentication bypass and only limited integrity impact is assessed. No public exploit code, and no confirmed active exploitation (CISA KEV), were identified at time of analysis, so this is a moderate, not top-tier, priority, reported to the vendor by Patchstack. Note that the vendor-supplied CVSS 7.1 rating is higher than the independent assessment because it assumes changed scope and low-level confidentiality and availability impact that are not supported by the described attack path.

Information disclosure in Craft CMS 5.0.0 through 5.10.12 can expose environment variables, secrets, database credentials, and other sensitive values when an independently occurring MySQL outage causes the application to treat the site as not installed. An unauthenticated attacker per the CVSS PR:N vector can reach anonymous installer actions such as install/validate-site if they previously obtained a valid guest session cookie and matching CSRF token and that session remains valid during the outage, then submit a predictable variable name and receive its expanded value. The flaw is gated by multiple stacked prerequisites, including an outage the attacker cannot induce and a pre-positioned valid session, and no public exploit identified at time of analysis; Craft CMS 5.10.13 contains the vendor fix.

Cross-site request forgery in AVideo (WWBN/AVideo) through 29.0 lets an attacker who lures an authenticated, upload-capable user to a crafted page fire cross-origin requests at objects/videoAddNew.json.php and silently rewrite video records. The endpoint disables AVideo's automatic CSRF guard and same-domain check whenever 'user' and 'pass' parameters merely appear in $_REQUEST, and because User::loginFromRequestIfNotLogged() returns early for an existing session, those attacker-supplied credentials are never validated and are simply discarded. A successful attack can transfer video ownership via setUsers_id and alter deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count; when the victim has administrator or Permissions::canAdminVideos() rights, any video on the site can be modified, including stripping group restrictions from private content. No public exploit code was identified at time of analysis, no vendor-released patch was available as of the advisory, and the attacker requires no authentication of their own (CVSS PR:N), though the victim must be a logged-in user with upload rights who is induced to visit the attacker's page (UI:P).

Stored OS command injection in the CloneSite plugin of AVideo (through version 29.0) lets an attacker who can plant a malicious SSH password - including through CSRF against an authenticated administrator - execute arbitrary shell commands as the crontab owner, commonly root or www-data, once the plugin's documented cron job runs. The CVSS 4.0 vector (AV:N/PR:N/UI:P) means unauthenticated remote attackers can trigger the chain but must socially engineer an already-authenticated administrator into submitting the crafted request, and exploitation also requires the CloneSite plugin to be enabled with its crontab installed plus one of two CSRF channels: a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset, or an attacker-controlled application co-hosted on the same hostname abusing the HTTPS SameSite=None session cookie. Default single-process Apache deployments are explicitly reported as not CSRF-exploitable, and no public exploit was identified at time of analysis, though the technical impact when the chain succeeds is full command execution with the injected payload persisted in the plugin configuration.

Cross-site request forgery in phpList before 3.6.17 allows remote attackers to silently delete and blacklist arbitrary subscriber addresses by inducing a logged-in administrator to load a crafted page, with no attacker credentials required on the target (CVSS 4.0 vector PR:N/UI:P). The vulnerable code path is the mass subscriber removal handler (public_html/lists/admin/massremove.php), which processes removal requests without validating a CSRF token, so the request is executed with the administrator's own session privileges. Rated 7.2 by the CVSS 4.0 vector and scored integrity high with limited availability impact by the independent assessment, the flaw requires the admin to be authenticated and to be lured into visiting an attacker-controlled page while that session is valid - this user-interaction prerequisite is the main limiting factor. Publicly available exploit code exists (referenced by VulnCheck and a public write-up), but there is no indication of confirmed active exploitation (not in CISA KEV).

Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.

Stored cross-site scripting in Concrete CMS versions below 9.5.4 allows an attacker to persist a JavaScript payload in the user timezone field (uTimezone), which the Dashboard user-management page renders without output encoding so that the script runs inside an administrator's authenticated session - enabling theft of CSRF tokens, creation of rogue administrator accounts, or modification of site settings. Exploitation is conditionally gated rather than a broad drive-by threat: it requires the non-default setting concrete.misc.user_timezones to be enabled, and the unauthenticated write path exists only in 9.5.3 and only when public registration is also enabled, while versions below 9.5.3 permit only an authenticated user to write the field via the account profile editor; an administrator must subsequently view the malicious user record. No public exploit code was identified at time of analysis, and the vendor's CVSS v4.0 score of 7.7 is substantially moderated by these stacked non-default preconditions, which our independent assessment reflects with a higher attack-complexity and user-interaction-dependent CVSS 3.1 vector.

Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cross-origin attacker page to drive a victim's cookie-authenticated SSE session, firing state-changing LiveView event handlers as that victim. Remote attackers need no authentication of their own, but exploitation requires the victim to be lured to an attacker-controlled page while holding an active authenticated djust session and while the SSE transport is enabled (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - integrity impact only, no confidentiality or availability impact). The flaw is fully fixed in 1.0.7 (Origin validated against ALLOWED_HOSTS with 403 for cross-origin requests, and POST endpoints now requiring Content-Type: application/json with 415 otherwise); no public exploit code was identified at time of analysis and the CVE has not been listed in CISA KEV.

Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.

Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fixed firmware build, so risk is real but conditional rather than an emergency patch-now scenario.

Cross-site request forgery in the Netcore NR255-V wireless router's web management interface (firmware 1.5.130703) allows an attacker to silently rewrite WAN and LAN settings by luring a logged-in administrator to a malicious page, which then fires forged requests at the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. The supplied CVSS 4.0 vector (7.0, AV:N/AC:L/AT:N/PR:N/UI:A) indicates the attacker does not need credentials of their own but must get an authenticated admin to actively interact, and that the resulting integrity and availability impacts are High while confidentiality is unaffected. No public exploit code was identified in the provided intelligence and the CVE is not listed in CISA KEV, so this is currently a disclosure-driven risk rather than a confirmed campaign.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.

Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.

Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) allows an attacker to silently overwrite a shopper's billing or shipping address while their checkout session is active, potentially redirecting a paid order to an attacker-controlled address. The cart, checkout and myprofile controllers omit CSRF token validation, so each forged request executes only with the victim's own session privileges — there is no cross-account data access. No public exploit code or active exploitation has been identified at time of analysis.

An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) lets anyone holding a valid download token/pid pair for a product download retrieve files outside the configured attachment folder. The J2StoreModelOrderdownloads::getFilePath() routine builds the on-disk path by concatenating the attachments directory with the stored product_file_save_name and only runs JPath::clean() plus JFile::exists(), so a ../ segment in that stored value resolves outside the folder and exposes files such as configuration.php to the web server's read permissions. No public exploit code and no CISA KEV listing were identified at time of analysis, but a CVSS 4.0 base score of 8.7 (VC:H, AV:N, PR:N) makes this a serious confidentiality risk for exposed J2Store storefronts.

Let me synthesize. Product: Concrete CMS. CVE-2026-81897: stored XSS via CSRF in Express entities forms dashboard controller save_control action, no anti-CSRF token validation. Authenticated admin tricked into submitting forged cross-site request → attacker-controlled headline and body values written to existing Express form Text control → emitted without output encoding → stored XSS. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N → 7.7. Note: CVSS 3.1 equivalent — for assessed_cvss_vector, I need my own. This is CSRF+stored XSS: AV:N, AC:L (or H due to requiring admin interaction), PR:N (attacker unauthenticated), UI:R (requires victim admin to visit a page / submit), S:C (scope change — attacker from web goes to admin's browser context... Actually with stored XSS in admin panel, scope could be C), C:H/I:H/A:H? Hmm. In classic CVSS 3.1 for CSRF leading to stored XSS in admin context, score would be like 8.0-8.8. Let's think: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N is typical for XSS (score 7.4). But here it's stored XSS that gives full admin session control → possibly full compromise. Concrete CMS admin XSS can lead to RCE (file manager, install packages). But from data, the impact per CVSS 4.0 is VC:H/VI:H/VA:H on the vulnerable system. So map to CVSS 3.1: C:H/I:H/A:H? Hmm, VI:H and VA:H — writing to form control, executing JS. VA:H means high availability impact — which is a peculiar mapping; concrete CMS team used the new "vulnerable system" impacts. I'll produce a reasonable 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N? Hmm. Let me be careful: with the attacker needing to craft cross-site request (AC:L), no privileges (PR:N), requiring user interaction (UI:R). Scope: the vulnerability in the web app causing script execution in the admin's browser — typically S:C for XSS. Impact: stored XSS executes with admin privileges → can change content, possibly execute code, availability impact indirect. I'd pick C:H/I:L/A:N under S:C

Unauthenticated user enumeration in Concrete CMS 9.0.0 through 9.5.2 allows any anonymous visitor to dump the complete backend account list — including internal user IDs, usernames and email addresses of every administrator and the super-administrator (user ID 1) — by sending an empty search to the /ccm/system/user/autocomplete endpoint and paginating the results. The endpoint enforces only a CSRF-style token that is bound to the selector's display options rather than to caller identity, and that token is handed out to anonymous visitors, so there is no authentication or privilege barrier to clear. No password hashes or session material leak, but the disclosed email and account inventory is a ready-made target list for credential stuffing, phishing and password-spray campaigns against named admins; no public exploit code and no CISA KEV entry are present in the supplied intelligence.

Missing CSRF token validation on the orphaned block removal action (`removeOrphanedBlocks`) in Concrete CMS 9.0.0 through 9.5.2 enables remote attackers to permanently destroy all block content on any page the victim can edit. By tricking an authenticated editor into loading a crafted URL, an attacker triggers deletion of every block on the targeted page's current version; blocks not aliased elsewhere are additionally purged from the global Blocks table and their block-type data tables, making the destruction irreversible without a database backup. No public exploit code identified at time of analysis; the Concrete CMS security team assigned a CVSS 4.0 score of 7.1 reflecting high integrity impact gated on one user interaction.

Stored Cross-Site Scripting in the Export & Import WPBakery Page Builder WordPress plugin (through 1.0.2) is achievable by any remote attacker who can lure a logged-in administrator into visiting a forged page. The plugin's template-import endpoint lacks CSRF protection and fails to sanitize imported template data before persisting and reflecting it, meaning a crafted template injected via a forged POST request stores malicious JavaScript that executes in the administrator's browser session. No public exploit is identified at time of analysis, and EPSS sits at 0.11%, suggesting limited opportunistic targeting.