Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.
CVE-2026-84759
Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.
#cwe-352
共收录 791 条相关情报。
← 返回所有主题Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.
CVE-2026-66652
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the e...
CVE-2026-81432
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX action
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logge...
CVE-2026-81426
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment st
TYPO3 CMS - Broken Access Control in Backend and Install Tool
CVE-2026-19418
### Problem The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/t
A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remo...
CVE-2026-73780
A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site R
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the att...
CVE-2026-73718
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated r
Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issu...
CVE-2026-18780
Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Manageme
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypas...
CVE-2026-83595
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s
AVideo Cross-Site Request Forgery via plugin/API/set.json.php
CVE-2026-83595
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCm...
CVE-2026-81890
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount co
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is ...
CVE-2026-81888
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but che...
CVE-2026-54599
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OI
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
CVE-2026-81888
### Summary The built-in social login providers accept an OAuth callback even when the `state` value is absent on both
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from...
CVE-2026-71378
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requ
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows...
CVE-2026-82647
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administ
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function...
CVE-2026-82544
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of th
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by by...
CVE-2026-82647
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administ
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Re...
CVE-2026-82544
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of th
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content