RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.
Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery.
This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery.
This issue affects BEAR: from n/a through 1.1.5.
Open Notebook version 1.8.1 contains an improper input validation vulnerability combined with an overly permissive default CORS configuration. This flaw allows a remote attacker to trick a legitimate user into altering or deleting arbitrary database entries via a specially crafted malicious URL. Depending on the deployment environment, the vulnerability may also enable data exfiltration.
Admidio versions prior to 5.0.9 contain a Cross-Site Request Forgery (CSRF) vulnerability in the preferences module. Several administrative operations such as database backup, test email, and htaccess generation are triggered via GET requests without CSRF token validation. Due to SameSite=Lax cookie behavior, an attacker can trick an authenticated admin into performing these actions by visiting a malicious page. This vulnerability has been fixed in version 5.0.9.
MasaCMS versions 7.5.2 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in the createBundle method of csettings.cfc. This flaw allows an attacker to trick a logged-in administrator into creating a site bundle without proper anti-CSRF token validation. The bundle is saved to a predictable, publicly accessible directory, enabling unauthenticated attackers to download sensitive site content, user data, password hashes, and configuration files. Fixed versions include 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
MasaCMS versions 7.5.2 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in the cTrash.restore function. This flaw allows an attacker to trick an authenticated administrator into restoring deleted content without proper anti-CSRF token validation. Exploitation can lead to restoration of malicious or outdated content, exposure of sensitive documents by moving them to public locations, and disruption of site structure or content integrity. The issue is fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
MasaCMS versions 7.5.2 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in the cTrash.empty function, which lacks anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into submitting a forged request that empties the trash, permanently deleting all deleted content. This results in irreversible data loss and disrupts content recovery. The issue is fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
MasaCMS versions prior to 7.2.10, between 7.3.0 and 7.3.15, between 7.4.0 and 7.4.10, and between 7.5.0 and 7.5.3 contain a Cross-Site Request Forgery (CSRF) vulnerability in the cUsers.updateAddress function. This flaw allows an attacker to trick a logged-in administrator into submitting unauthorized requests that can add, modify, or delete user address information, including email addresses and phone numbers. The vulnerability has been addressed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. Mitigations include restricting administrative backend access, using browser isolation for admin sessions, or filtering forged requests.
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
The Publish 2 Ping.fm WordPress plugin up to version 1.1 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation on a specific admin options page. This vulnerability allows unauthenticated attackers to trick site administrators into performing unwanted actions, such as updating settings or injecting malicious scripts via forged requests. The CVSS score is 6.1, indicating a medium severity impact. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The DX Sources WordPress plugin up to version 2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in the settings_page_build function. This flaw allows an attacker to trick a logged-in administrator into submitting a forged request that modifies plugin configuration settings. The vulnerability requires user interaction, such as clicking a malicious link, and does not allow direct compromise of confidentiality or availability. The CVSS score is 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The addfreespace plugin for WordPress up to version 0.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This flaw allows unauthenticated attackers to potentially update plugin settings and inject malicious scripts if they can trick a site administrator into performing an action such as clicking a crafted link. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
A Cross-Site Request Forgery (CSRF) vulnerability exists in goshs versions prior to 2.0.2. The PUT upload handler lacks CSRF token validation, allowing any website to write arbitrary files to a vulnerable goshs instance via a victim's browser. This is facilitated by an unconditional Access-Control-Allow-Origin: * header on the OPTIONS preflight handler, which bypasses network isolation protections. The issue has been addressed in goshs version 2.0.2.
The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the 'handle_module_actions' function. This makes it possible for unauthenticated attackers to toggle plugin modules on or off via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
CVE-2026-41317 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Frappe custom app 'press', which manages infrastructure and SaaS on Frappe Cloud. The vulnerable endpoint 'press.api.account.create_api_secret' allows database writes and is accessible via the GET method, enabling CSRF-like exploits. A patch has been committed that restricts this endpoint to POST requests only, mitigating the vulnerability.
CVE-2026-27841 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting the SenseLive X3050 web management interface. The vulnerability arises because the application does not implement server-side validation of request origin nor CSRF tokens, allowing unauthorized state-changing operations to be triggered via a malicious external webpage. This could enable an attacker to cause a user's browser to submit unauthorized configuration requests to the device without user interaction. There is no official patch or remediation level currently provided by the vendor. No known exploits are reported in the wild at this time.
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g.creating new user accounts).
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.