Cross-Site Request Forgery

Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. No public exploit has been identified at time of analysis, but fixes are confirmed available in GitHub releases 3.3.12 and 5.1.11.

Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.

Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.

Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.

Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.

Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).

Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.

Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.

Missing authorization in OpenReception's appointment booking platform (before 1.0.1) lets any unauthenticated network attacker POST to `/setup/create-admin-account` and mint additional GLOBAL_ADMIN accounts on an already-claimed, fully configured instance. The created account is immediately active (`is_active=true`, `confirmation_state=ACCESS_GRANTED`) with no email confirmation, granting full platform-level administrative control and successful login and tenant enumeration. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the root cause is confirmed by the vendor GHSA advisory and fix commit.

Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.

Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.

Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.

Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.

CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.

Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.

Unauthenticated IDOR write in PeproDev WooCommerce Receipt Uploader (all versions ≤ 2.8.0) allows any remote attacker to submit or manipulate receipt uploads without credentials or authorization checks, bypassing the WordPress nonce and capability verification that WooCommerce plugins are expected to enforce. The plugin remains unpatched as of the time of writing, and a publicly available proof-of-concept exploit exists via WPScan. Despite automation potential (SSVC: Automatable yes), EPSS sits at 0.10% (1st percentile) and CISA has not listed this in KEV, indicating limited observed real-world exploitation to date.

Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker to bind a victim's browser session to the attacker's own Teams identity. Livebook versions 0.15.0 through 0.18.6 and 0.19.0 through 0.19.8 are affected when the Livebook Teams ZTA provider is configured, as the OAuth callback handler accepts any valid authorization code without verifying it was issued for the current browser session. The attacker cannot authenticate as the victim, but the victim unknowingly operates under the attacker's identity, exposing notebooks, secrets, and uploaded data to the attacker's account. No public exploit code has been identified and active exploitation has not been confirmed by CISA KEV.

Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigger unauthorized administrative actions - including changes to security configuration - on behalf of an authenticated administrator who is deceived into visiting a malicious web page. Affected versions span the 11.x line before 11.3.6 and the 12.x line before 12.0.3, with fixes available from Progress Software. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.

Cross-site request forgery in OpenBK7231T firmware's /cfg_wifi_set endpoint allows a remote attacker to simultaneously hijack a device's WiFi credentials and silently disable its web admin password protection via a single malicious HTTP GET request triggered in an authenticated admin's browser. The vulnerability is compounded by a logic flaw: omitting the `web_admin_password_enabled` parameter from the CSRF request causes an else-branch to clear the admin password entirely, leaving the device fully open. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.

Full account takeover in DjangoCRM stems from a hardcoded Django SECRET_KEY committed in webcrm/settings.py, letting anyone who reads the public GitHub repository forge session cookies (including the superadmin), CSRF tokens, and password reset tokens. The default DEBUG=True setting compounds this by exposing database, email, and OAuth credentials plus internal paths on error pages. No public exploit is identified at time of analysis, but exploitation is trivial and requires no authentication (CVSS 9.1, PR:N).

Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.

Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.

Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.

Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.

Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.

Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.

Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.

User-agent session binding in oidcc_plug's OpenID Connect authorization plug is silently rendered inert by a case-sensitivity bug, affecting all versions from 0.1.0-alpha.3 through 0.5.0 that configured check_useragent: true. The authorize plug reads the User-Agent header using a mixed-case key, but Plug normalizes all HTTP header names to lowercase before storage, so the lookup always returns an empty list and nil is written into the OIDC session; the callback plug then treats a stored nil as nothing to compare and returns :ok unconditionally, meaning a stolen session replayed from a different browser or device passes the user-agent check without detection or logging. No public exploit has been identified at time of analysis, and CSRF/state, nonce, and PKCE protections remain fully functional.

Login CSRF in oidcc_plug (versions 0.2.0-beta.1 through 0.5.0) enables an attacker to silently sign a victim into the attacker's own identity provider account by luring the victim to a crafted OIDC callback URL carrying the attacker's authorization code. The root cause is that Oidcc.Plug.AuthorizationCallback.call/2 substitutes permissive defaults (`:any` nonce, `:none` PKCE and state verifiers) when no prior Oidcc.Plug.Authorize session exists instead of rejecting the stateless request outright, causing every downstream security check - nonce, state, PKCE, peer IP, and user-agent binding - to silently pass against nothing. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack primitive is straightforward for any attacker holding an account at the same identity provider.

Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.

Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.

Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.

Cross-site request forgery in the Frontend File Manager Plugin for WordPress (all versions through 23.6) enables attackers to silently modify file metadata belonging to authenticated users by luring victims to attacker-controlled pages, with the corrupted metadata directly enabling unauthorized download of those files. When the plugin's guest upload feature is active, the vulnerable metadata update endpoint becomes fully unauthenticated, eliminating the need for any victim interaction and exposing every user's uploaded files to arbitrary metadata manipulation. WPScan has published a proof-of-concept, though EPSS at 0.10% (1st percentile) indicates limited observed exploitation activity to date - no public exploit identified at time of analysis reaches CISA KEV status.

Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.

Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.

Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.

CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.

Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.

Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.

Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.

Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker who lures an authenticated user to a malicious page read sensitive JSON responses and force state-changing wiki actions in the victim's session. The flaw (CWE-352) is fixed in 2.12.4 and carries a vendor CVSS of 8.8, though exploitation requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.

Cross-Site Request Forgery in the FuseWP WordPress plugin (all versions ≤ 1.1.24.2) allows unauthenticated attackers to toggle email-marketing sync rule states by tricking an authenticated administrator into triggering a forged request. The root cause is missing nonce verification on the toggle_sync_status() AJAX handler in AjaxHandler.php (line 149), meaning WordPress's built-in CSRF protection is entirely absent for that state-changing action. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.3 Medium correctly reflects the limited impact scope - the attacker can only enable or disable sync rules, not read data or execute code.

Cross-Site Request Forgery in Apache Zeppelin 0.6.0 through 0.12.0 allows an attacker who lures an authenticated user to a malicious webpage to perform unauthorized actions across the full REST API and WebSocket endpoint surface on the victim's behalf. The vulnerability stems from a permissive default CORS configuration combined with server-side acceptance of text/plain request bodies - a combination that bypasses standard browser preflight CSRF defenses without requiring any special exploit code. No public exploit or CISA KEV listing has been identified; the vendor rates this moderate and has released a patch in version 0.12.1.

Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.

Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.

Cross-site request forgery in balbooa Gridbox, a page-builder extension for Joomla, allows attackers to forge state-changing admin actions in versions prior to 2.20.2 by tricking an authenticated administrator into loading a malicious page. The flaw spans multiple CSRF vectors in the admin interface and carries high confidentiality and integrity impact (CVSS 7.3), though EPSS is only 0.10% and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' with 'total' technical impact, indicating serious potential consequence but no observed weaponization.

Cross-site request forgery in the RO CSVI (CSV Improved) import/export extension for Joomla by rolandd.com affects all versions from 1.0.0 up to but not including 9.11.0, allowing an attacker to forge requests to the extension's AJAX endpoint handlers. By tricking an authenticated administrator into visiting a malicious page, an attacker can trigger state-changing operations on the victim's behalf, with the CVSS 8.8 vector indicating high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the very low EPSS score (0.10%, 1st percentile) suggests exploitation is not currently widespread.

Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.

Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.

Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.

Unauthenticated SQL injection in the Bookly WordPress plugin permits remote extraction of database content. Attackers leverage a two-step chain—first carrying a malicious staff_ids parameter via a session-seeding AJAX call, then triggering the vulnerable query through a second endpoint—to append time-based blind SQL payloads. No public exploit code is known, but the full attack path is documented by Wordfence.

Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.

Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.

Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.

Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.

Reflected XSS in OpenAM's OAuth2/OIDC consent page allows attackers to execute arbitrary JavaScript in the victim's authenticated session, enabling session theft and administrative takeover. Affects OpenAM versions 13.0.0 through 16.1.1. No active exploitation confirmed, but the attack vector is straightforward and publicly documented.

Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.

Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.

Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.

Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.

Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.

Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.

Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.

Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.

Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.

Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.

Cross-site request forgery in the Cache Cleaner extension for Joomla allows an authenticated administrator with cache-management permission to be tricked into performing unauthorized URL purges due to inconsistent token validation. Affected versions 1.0.0 through 9.7.6 may experience limited confidentiality and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is low (0.13%).

Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low.

Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 through 6.3.8. An attacker can trick a logged-in Joomla administrator into submitting a request that performs unauthorized database modifications, potentially compromising all data confidentiality, integrity, and availability. EPSS indicates a low 0.13% exploitation probability, and no active exploitation or public exploit is known at this time.

We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent

Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.

We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction

Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.

Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified.

Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.

Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.