Cross-Site Request Forgery

Cross-site request forgery in NETGEAR's XR500, XR1000, and XR1000v2 gaming routers allows an adjacent-network attacker to tamper with router configuration and disrupt operations by tricking a logged-in administrator into visiting a malicious page. The vulnerability stems from absent or insufficient CSRF protections on the router's web management interface, enabling forged requests to be submitted on behalf of an authenticated admin. No confidentiality impact is present; exploitation requires both social engineering success and admin-session timing, but can result in full configuration integrity loss and service disruption. No public exploit or CISA KEV listing is identified at time of analysis.

Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.

Login CSRF in a Nozomi Networks web-based platform - affecting both standard credential and SAML authentication flows - allows a network-accessible attacker holding a valid account to trick a victim into silently authenticating under the attacker's identity, causing the victim's subsequent actions to be attributed to the attacker's account in the audit log. The root cause is the absence of anti-CSRF token validation on the login endpoints themselves, a class of flaw distinct from conventional post-login CSRF. The CVSS 4.0 score of 5.1 reflects constrained prerequisites (attacker credential ownership and passive victim interaction); no public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.

Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.

Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.

Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.

Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.

Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.

Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.

Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. Because session cookies are configured with SameSite=Lax, a single crafted link navigated by the victim automatically includes their session cookie, silently transitioning the target order from pending to confirmed. Sequential integer order numbers further allow an attacker to enumerate and mass-confirm all outstanding orders in a single automated sweep. No public exploit or KEV listing is identified at time of analysis; vendor patch is available in 5.15.11.

Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.

Cross-site request forgery in AVideo's removePoster.php endpoint allows network-accessible attackers to permanently delete an authenticated victim's live poster and thumbnail files by tricking them into loading a crafted page. The endpoint accepts state-changing file-deletion operations over HTTP GET while performing neither POST-method enforcement (forbidIfNotPost) nor CSRF token validation (forbidIfInvalidToken), making the attack trivially embeddable in an HTML image tag. No active exploitation or public exploit code has been identified at time of analysis.

Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).

Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.

Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium).

Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.

CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.

Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.

CSRF protection is absent for the netmount command in elFinder prior to 2.1.70, allowing a cross-site request from an attacker-controlled page to mount an attacker-chosen FTP server into an authenticated victim's session without a valid X-elFinder-CSRF token. Because the default connector.minimal.php-dist configuration enables FTP mounts and passes fully attacker-controlled parameters - host, port, credentials, path - directly to elFinderVolumeFTP, this also creates a server-side request forgery primitive: the PHP process itself initiates a TCP connection to the attacker-specified host and port. A vendor-confirmed patch is available in version 2.1.70; no public exploit has been identified at time of analysis.

OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. An attacker who tricks a victim into visiting a crafted OAuth callback URL can silently bind the attacker's third-party identity to the victim's session (login CSRF) or permanently link the attacker's account to the victim's account (forced account linking), enabling later sign-in as the victim. No public exploit has been identified at time of analysis.

Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.

Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.

Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.

Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.

CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.

Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.

Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.

UpdraftPlus: WP Backup & Migration Plugin for WordPress (all versions before 1.26.7) exposes a backup restoration action without CSRF token validation, enabling a remote attacker to revert a site's entire database and files to a prior backup state by tricking a logged-in administrator into clicking a crafted link. The integrity impact is high - a successful exploit silently undoes content updates, security hardening, and user data accumulated since the backup was taken. No public exploit is identified at time of analysis; EPSS sits at the 1st percentile and SSVC marks exploitation as none, indicating low current threat activity.

Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute arbitrary Nagios commands on behalf of an authenticated user by exploiting a bypass in the double-submit cookie CSRF protection implemented in cmd.cgi. When the Cookie header is absent in a POST request, the server's CSRF check can be satisfied simply by supplying matching NagFormId and nagFormId values in the POST body - a condition entirely within the attacker's control. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the technique is well-understood and the bypass mechanism is straightforward to reproduce.

Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring commands by tricking an authenticated administrator into visiting a malicious page. The flaw in cmd.cgi stems from a logic inversion: the CSRF protection mechanism treats an absent NagFormId cookie as a passing check rather than a failing one, rendering the protection entirely ineffective. The CVSS 4.0 vector (VI:H, UI:A) confirms real integrity risk - an attacker can issue commands under a victim session - though user interaction is required and no public exploit or CISA KEV listing exists at time of analysis.

Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.

Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.

Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.

Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.

Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.

Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.

Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.

Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.

Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.

CSRF protection is absent on front-end state-changing operations in YOOtheme's Zoo Joomla extension before version 4.1.66, enabling an attacker to forge requests that alter application state on behalf of a high-privileged authenticated user. Exploitation requires luring a logged-in administrator or privileged Zoo user to interact with a malicious page while their session is active. The integrity impact is limited to the vulnerable system, and no public exploit code or active exploitation has been identified at time of analysis.

CSRF in the LitExtension WordPress migration plugin (≤1.2.5) allows an unauthenticated remote attacker to overwrite the store-migration connector's authentication token by tricking a logged-in administrator into clicking a crafted link. Token replacement gives the attacker control over the connector, potentially enabling unauthorized access to migrated store data or disruption of active migration workflows. A publicly available proof-of-concept exploit was published via WPScan; this vulnerability has not been added to the CISA KEV catalog at time of analysis.

Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.

Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.

Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.

Cross-Site Request Forgery in Frappe Framework 16.31.0 and earlier allows an unauthenticated attacker to forge workflow approval actions on behalf of any authenticated victim user, because the bulk_workflow_approval endpoint in frappe/model/workflow.py accepts state-mutating requests via safe HTTP methods (GET) in addition to POST. The attacker needs only to lure an authenticated user to a crafted page or link, causing their browser to silently submit an approval with the victim's session credentials. No released patched version is available at time of analysis; the upstream fix exists only as an unmerged PR and commit.

Cross-Site Request Forgery in ATutor 2.2.4 allows a network-based attacker to modify authenticated users' profile fields by tricking them into visiting a malicious webpage that submits a forged profile-update request. The application lacks CSRF token validation on the profile update endpoint, so the server cannot distinguish forged requests from legitimate ones. No patch exists or will be released, as ATutor is end-of-life; no public exploit code or active exploitation has been identified at time of analysis.

Cross-site request forgery in the TinaCMS CLI dev server allows an attacker-controlled web page to write arbitrary files into a developer's local media root without their knowledge. The Vite dev server's CORS middleware only suppressed response headers for disallowed origins but never terminated the underlying request, and because multipart/form-data is a browser 'simple request' exempt from CORS preflight, an attacker page can silently drive a complete media upload to completion. Exploitation requires the targeted developer to visit an attacker-controlled page while tinacms dev is running locally; no public exploit identified at time of analysis, though a researcher-validated proof-of-concept is documented in GHSA-rgr9-r7mj-mf6x. Vendor-released patch: @tinacms/cli@2.5.2.

Dashboard Studio workflow actions in Splunk Enterprise can be weaponized by a 'power'-role user to store attacker-controlled SPL that executes under a victim's permission context when triggered via Event Actions. Affected versions span all major branches: 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation enables unauthorized read and write access to data within the victim's Splunk permission scope.

Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.

Cross-site request forgery in OpenEMR's DICOM viewer (versions before 8.3.0) allows an unauthenticated attacker to force an authenticated user holding 'Patients - Documents' permissions to issue arbitrary state-changing requests to OpenEMR endpoints, including forced logout. The unsanitized reflection of the `web_path` GET parameter in `library/dicom_frame.php` is the root mechanism: a crafted URL delivers the malicious payload via the victim's own authenticated session. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com) allows attackers to trick authenticated users into performing unauthorized state-changing actions across a broad set of unprotected endpoints. Missing CSRF tokens span both frontend operations - contact forms, cart, bookmarks, file uploads, messages, and AI text generation - and sensitive administrator actions including demo-data wipe, app install, cache archiving, and mobile push notification dispatch. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.6 reflects mandatory victim interaction and the requirement for an authenticated session.

Header spoofing in fastify 5.8.3 through 5.12.0 persists despite the prior CVE-2026-3635 patch because the numeric trustProxy form compiles to a hop-count predicate that structurally ignores the connecting address, rendering the guard introduced by the earlier fix completely ineffective for this configuration. An attacker who can reach the Fastify origin server directly - bypassing the front-facing reverse proxy - can forge X-Forwarded-For, X-Forwarded-Host, and related fields that fastify uses to derive request.ip, request.hostname, request.host, and request.protocol, enabling host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin spoofing, and host-based routing and cache poisoning. No public exploit has been identified at time of analysis; the vendor-released fix is fastify 5.12.1, which disables the numeric trustProxy form entirely.

Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.

Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. No public exploit has been identified at time of analysis, but the attack path is technically straightforward and targets a routine administrative workflow that reliably delivers the payload.

Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.

Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.

CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.

Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.

Cross-site request forgery in SourceCodester Online Examination & Learning Management System 1.0 enables remote attackers to perform unauthorized state-changing actions on behalf of authenticated users by tricking them into visiting a crafted page or clicking a malicious link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L) confirms the attack is network-initiated without attacker authentication, though victim interaction is required and impact is limited to partial integrity loss within the vulnerable system. No public exploit code or CISA KEV listing exists at time of analysis.

Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.

Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.

Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.

SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.

Cross-site request forgery in the iCagenda Joomla extension (versions prior to 4.0.11) exposes multiple frontend state-changing operations - including event registration actions - to forged HTTP requests, because no CSRF token validation is applied to those endpoints. Any Joomla site running a vulnerable iCagenda release allows an attacker to trigger registrations or other frontend mutations on behalf of an authenticated visitor who is socially engineered into loading a crafted page. No public exploit has been identified at time of analysis, and the vendor has addressed the issue in version 4.0.11.

Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.

Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.

Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.

Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.

Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory https://www.ibm.com/support/pages/node/7283486.

Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.

Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.

Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.

JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.

Cross-site request forgery in the ShopEngine Elementor WooCommerce Builder Addon for WordPress (versions before 4.9.3) enables an unauthenticated remote attacker to silently authenticate a victim into an attacker-controlled WordPress account by tricking the victim into visiting a malicious page. When the victim subsequently proceeds to WooCommerce checkout, all billing and shipping details they enter are stored under and readable by the attacker, exposing personally identifiable information. No active exploitation is confirmed (not listed in CISA KEV), the EPSS score is 0.11% (2nd percentile) indicating very low current exploitation probability, and a vendor-released patch is available in version 4.9.3.

Cross-site request forgery in basecamp/upright's Alertmanager and Prometheus proxy controllers allows unauthenticated attackers to exploit authenticated user sessions by inducing browser-submitted requests that bypass Rails CSRF protection entirely. At the specific commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, both proxy controllers skip the Rails authenticity token check, exposing upstream monitoring write and management APIs - including Alertmanager silence creation and Prometheus configuration reload - to attacker-controlled actions without the victim's awareness. A public proof-of-concept gist has been published by the reporting researcher, and no patched release has been confirmed at time of analysis.

Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.

Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.

Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.

Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.

Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.

Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.

Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).

Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped components that read request-scoped context. On a warm server instance, when two requests share comparator-equal props, the memoized render from the first request is served to the second user verbatim - bypassing per-request context isolation for values obtained via createContext()/useContext(), useRequestContext(), or getContext(). This can leak another user's profile data, CSRF tokens embedded in HTML, or role-gated content. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a confirmed fix in v4.12.34.