ATutor version 2.2.4 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its profile update functionality. This vulnerability allows an attacker to craft a malicious website that, when visited by an authenticated user, can submit a forged request to modify the victim's profile fields without their consent. The product is no longer actively supported, and no fixes have been released for this issue.
CVE-2026-28164 is a critical Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons. It affects versions up to and including 2.3.7. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 9.6, indicating a high severity with potential for complete compromise of confidentiality, integrity, and availability.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.64. The issue arises because the comment controller endpoint does not enforce Access Control List (ACL) checks, allowing unauthenticated users to modify tags without authorization. This vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-14951 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in Frauscher Sensortechnik FDS 102. A low privileged remote attacker can trick authenticated users into performing unintended actions via malicious web pages. This affects versions 2.0.0 through 2.13.3 inclusive. The vulnerability allows unauthorized state-changing operations in the web interface without direct user consent.
CVE-2026-63123 is a Cross-Site Request Forgery (CSRF) vulnerability in the TinaCMS CLI package prior to version 2.5.2. The issue arises because the Vite dev server's origin callback returns false for disallowed origins but does not reject the request, allowing POST requests to /media/upload/* to be processed. This enables a remote attacker to cause a developer's browser to submit a state-changing request, potentially uploading attacker-controlled multipart content to the configured media root. The vulnerability is fixed in version 2.5.2.
CVE-2026-18848 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting IBM Power Systems Firmware ASMI web interface. An attacker can trick a logged-in ASMI administrator into visiting a malicious web page, which may cause unauthorized administrative actions on the FSP. This can impact confidentiality, integrity, and availability of the managed system.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
OpenEMR versions before 8.3.0 have a cross-site request forgery (CSRF) vulnerability in the DICOM viewer. The vulnerability arises because the web_path GET parameter is embedded unsanitized as a URL without validation. This allows an attacker to craft a malicious URL that causes an authenticated user with Patients - Documents permissions to perform unintended authenticated requests, such as forced logout or other state-changing actions.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The flaw arises because tokens were missing on many AJAX and state-changing tasks, including contact and quote forms, cart operations, bookmarks, uploads, messages, AI text generation, and several administrator actions. Exploitation requires a valid session: frontend attacks need a registered or listing-owner session, while admin attacks require a backend administrator session. The vulnerability has a medium severity rating with a CVSS score of 4.6.
CVE-2026-66602 is a Cross-Site Request Forgery (CSRF) vulnerability in the DevItems HashBar – WordPress Notification Bar plugin. This vulnerability affects versions up to and including 2.0.0. It allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
A Cross-Site Request Forgery (CSRF) vulnerability exists in MobSF Mobile-Security-Framework-MobSF versions prior to 4.5.1. The issue arises because the CSRF middleware is only configured in a deprecated setting and omitted from the active middleware configuration, allowing remote attackers to trick logged-in users into submitting unauthorized POST requests. This can lead to unauthorized actions such as deleting scans, uploading or downloading applications, changing passwords, or managing users with the victim's permissions. The vulnerability is fixed in version 4.5.1.
CVE-2026-66635 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the 10Web Slider plugin up to version 1.2.63. This vulnerability allows an attacker to induce an authenticated user to perform unwanted actions on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.4. No patch or official fix information is provided in the available data.
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a Cross-Site Request Forgery (CSRF) vulnerability due to improper validation of anti-CSRF tokens. This flaw allows a remote authenticated attacker to bypass security restrictions without user interaction. The vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity. No official patch or remediation guidance is currently provided by the vendor.