The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
CVE-2024-40685 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting IBM Operations Analytics – Log Analysis versions 1.3.5.0 through 1.3.8.3 and IBM SmartCloud Analytics – Log Analysis. This vulnerability allows an attacker to trick an authenticated user into performing unauthorized actions without their consent. Exploitation requires user interaction but no prior authentication or elevated privileges. The vulnerability impacts the integrity of the system by enabling unauthorized changes but does not affect confidentiality or availability.
CVE-2026-25151 is a Cross-Site Request Forgery (CSRF) vulnerability in QwikDev's Qwik JavaScript framework versions prior to 1.19.0. The issue arises from inconsistent interpretation of HTTP request headers, specifically Content-Type headers, by Qwik City's server-side request handler. This flaw allows remote attackers to bypass CSRF protections by crafting or using multi-valued Content-Type headers, potentially leading to unauthorized actions with elevated integrity impact. The vulnerability has a CVSS score of 5.9 (medium severity) and requires user interaction but no authentication. It affects web applications built on vulnerable Qwik versions and has no known exploits in the wild yet. The issue was patched in version 1.19.
CVE-2026-25155 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Qwik JavaScript framework versions prior to 1.12.0. The flaw stems from a typo in the regular expression used by the isContentType function, causing improper parsing of certain Content-Type headers. This parsing error can be exploited by attackers to craft malicious requests that bypass normal CSRF protections, potentially leading to unauthorized actions with high integrity impact but low confidentiality and no availability impact. The vulnerability requires user interaction and remote network access but no authentication. Although no known exploits are reported in the wild, organizations using vulnerable Qwik versions should upgrade to 1.12.0 or later. European organizations that heavily rely on Qwik for web applications, especially in countries with significant software development ecosystems, are at risk.
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior does not implement CSRF protections for administrative functions in the web management interface. The interface does not enforce anti-CSRF tokens or robust origin validation, which can allow an attacker to induce a logged-in administrator to perform unintended state-changing requests and modify router settings.
CVE-2026-24666 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Open eClass versions prior to 4.2. This vulnerability allows attackers to trick authenticated teachers into executing unintended actions, such as modifying assignment grades, by sending crafted requests. The flaw exists in multiple teacher-restricted endpoints and requires the victim to be authenticated and interact with a malicious link or page. The vulnerability has been patched in version 4.2. With a CVSS score of 6.5, it is classified as medium severity. There are no known exploits in the wild currently. European educational institutions using Open eClass versions before 4.
The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce validation on the create_or_update_note function. This makes it possible for unauthenticated attackers to create or update contact notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to missing sanitization and escaping this can lead to stored Cross-Site Scripting.
CVE-2026-25221 is a Cross-Site Request Forgery (CSRF) vulnerability in the OAuth 2.0 login implementation of PolarLearn versions up to 0-PRERELEASE-15. The flaw arises because the application does not implement or verify the OAuth state parameter during authentication with GitHub and Google providers. This allows attackers to trick victims into logging into the attacker’s account, causing victims’ data and academic progress to be stored under the attacker’s profile. The vulnerability leads to data loss for victims and potential information disclosure to attackers. Exploitation requires user interaction but no prior authentication. The CVSS score is low (2.3), reflecting limited impact on confidentiality and availability, but the integrity of user data is affected. No known exploits are currently reported in the wild. European organizations using PolarLearn should be aware of this risk, especially educational institutions relying on this platform for learning management.
CVE-2026-24007 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Enalean's Tuleap software versions prior to 17.0.99.1768924735. The flaw exists in the 'Overview inconsistent items' functionality, where missing CSRF protections allow attackers to trick authenticated users into performing unintended actions, specifically repairing inconsistent items by creating artifact links from releases. Exploitation requires the victim to be authenticated and interact with a maliciously crafted request. The vulnerability impacts the integrity and availability of the affected system but does not compromise confidentiality. Fixed versions have been released in both the Community and Enterprise Editions. European organizations using vulnerable Tuleap versions for software development management should prioritize patching to prevent potential misuse. No known exploits are reported in the wild as of now.
CVE-2026-0658 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability affecting the Five Star Restaurant Reservations WordPress plugin versions prior to 2.7.9. The vulnerability arises because the plugin lacks proper CSRF protections on certain bulk action functionalities, allowing an attacker to trick authenticated admin users into performing unintended actions, such as deleting bookings. Exploitation requires the victim to be logged in as an admin and to interact with a maliciously crafted web page. The vulnerability impacts the integrity of booking data but does not affect confidentiality or availability. No known exploits are currently reported in the wild. Organizations using this plugin should update to version 2.7.9 or later to mitigate the risk.
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
CVE-2025-14472 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Drupal's Acquia Content Hub versions before 3.6.4 and between 3.7.0 and 3.7.3. The vulnerability allows attackers to trick authenticated users into executing unwanted actions on the Content Hub without their consent, potentially leading to unauthorized data modification or leakage. Exploitation requires user interaction but no privileges or authentication from the attacker. The vulnerability impacts confidentiality and integrity but not availability.
CVE-2025-13982 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting the Drupal Login Time Restriction module versions before 1.0.3. This vulnerability allows an attacker to trick authenticated users into executing unwanted actions related to login time restrictions without their consent. Exploitation requires user interaction but no privileges or authentication are needed, and it can result in high confidentiality and integrity impacts. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to Drupal sites using this module. European organizations relying on Drupal for web content management could face unauthorized changes to login policies, potentially leading to unauthorized access or denial of legitimate access. Mitigation involves promptly updating the module to version 1.0.3 or later once available, implementing anti-CSRF tokens, and monitoring for suspicious activity.
The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in the ss_addtoallowlist class. This makes it possible for unauthenticated attackers to add arbitrary email addresses to the spam allowlist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability was partially patched in version 2026.1.
Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete all commands via '/delete_all_commands?sid='.
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.