A Cross-Site Request Forgery (CSRF) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.11.1. The plugin does not verify a CSRF nonce before saving mail settings, allowing an attacker to manipulate the site's outbound mail configuration by tricking an authenticated administrator into visiting a malicious page. This can lead to the attacker controlling SMTP server settings and notification recipients.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the labstack Echo Go web framework's MethodOverride middleware prior to versions 4.16.0 and 5.4.0. When MethodOverride is registered before CSRF middleware in the routing chain, the HTTP method override causes CSRF token validation and Sec-Fetch-Site checks to be bypassed, allowing an authenticated attacker to perform state-changing actions via a crafted cross-site request. This issue is fixed in versions 4.16.0 and 5.4.0.
MemberPress plugin for WordPress versions up to 1.14.1 contains a Cross-Site Request Forgery (CSRF) vulnerability due to a bypassable nonce verification in the save_profile_fields() function. This flaw allows unauthenticated attackers to change authenticated users' email addresses by tricking them into clicking a malicious link, potentially leading to account takeover via password reset.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions up to and including 1.4.8. The vulnerability arises from missing or incorrect nonce validation in the condtext_update_tmpl function, allowing unauthenticated attackers to inject arbitrary PHP code into executable template files. This code can be executed later by the plugin, leading to remote code execution on the server if an administrator is tricked into performing an action such as clicking a malicious link. Exploitation requires administrator interaction and bypasses sanitization mechanisms due to the plugin's placeholder expansion and code cleaning logic.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Media Library Assistant WordPress plugin before version 3.42. The plugin does not verify a CSRF nonce on its Empty Trash media action, allowing a forged request to cause a logged-in user with Editor role or higher to permanently delete all trashed media attachments.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Media Library Assistant WordPress plugin before version 3.42. The plugin does not consistently validate its CSRF nonce on the Media Library bulk-action handler, allowing a forged request that omits the nonce field to cause a logged-in user with the Author role or higher to trash or delete attachments.
CVE-2026-116839 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious page, causing unauthorized changes and potentially triggering a Denial of Service (DoS) condition on the device. The vulnerability affects versions before 6.3.26 and has a high severity rating with a CVSS score of 7.1. A fix is available in version 6.3.26.
CVE-2026-116838 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious webpage, which then triggers a command injection on the device. This vulnerability affects versions prior to 6.3.26 and has a high severity rating with a CVSS score of 8.8. The issue has been fixed in version 6.3.26.
boneIO Black versions from 1.2.0 up to but not including 1.6.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks on all state-changing API endpoints. The product lacks CSRF tokens and does not validate Origin or Referer headers, allowing remote attackers to craft malicious webpages that can trigger unauthorized actions such as rebooting the controller or toggling relays. This vulnerability leads to loss of integrity and availability. The issue was fixed in version 1.6.0.
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Uni-CLI versions prior to 0.225.2 exposed a legacy JSON-RPC-over-HTTP transport on localhost without validating browser Origin headers. This allowed malicious web pages to send CORS POST requests to the local /mcp endpoint and execute JSON-RPC commands against the local Uni-CLI server if the MCP HTTP transport was active. The issue was due to inconsistent enforcement of the browser-to-localhost boundary between two HTTP transports. This vulnerability has been fixed in version 0.225.2.
CVE-2026-93631 is a cross-site request forgery (CSRF) vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition. It allows an attacker to link their external account to a victim's mailbox by exploiting the OAuth callback's failure to bind state or authorization code to the initiating session. This can lead to persistent import of attacker-controlled contacts or calendar events, potentially disclosing sensitive appointment information. Versions 0 through 10.1.20 of ZCS are affected.
CVE-2026-75779 is a high-severity vulnerability in an ASUS router model involving OS command injection combined with Cross-Site Request Forgery (CSRF). This flaw allows an attacker to trick a logged-in administrator into visiting a malicious website, which then causes the router to execute arbitrary commands with root privileges. The vulnerability arises from improper neutralization of special elements used in OS commands and the presence of CSRF, enabling unauthorized command execution.
CVE-2026-115494 is a cross-site request forgery (CSRF) vulnerability in KNIME Business Hub versions prior to 1.19.0. The flaw allows an authenticated attacker to change the state of a resource without the user's knowledge through a CSRF attack requiring only passive user interaction. The issue is fixed in version 1.19.0. As a workaround, deploying an API gateway or firewall to remove the X-Forwarded-For header from incoming requests can mitigate the risk.
CVE-2026-114719 is a Cross-Site Request Forgery (CSRF) vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw exists in the mark-as-junk action of the markasjunk plugin, where the _uid parameter from POST data is improperly handled, allowing the action to be executed without a valid CSRF token. This issue was fixed by explicitly constraining input to POST data in version 1.6.20 and 1.7.5.
CVE-2026-96374 is a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Project Browser component. It affects versions from 0.0.0 up to but not including 2.0.3, and from 2.1.0 up to but not including 2.1.5. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue has been fixed in versions 2.0.3 and 2.1.5.
CVE-2026-96388 is a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Tawk.to live chat application. It affects versions from 0.0.0 up to but not including 3.0.4. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue has been fixed in version 3.0.4.