djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with `credentials: include` to fire state-changing event handlers as the victim. The URL `session_id` is client-chosen (validated only for UUID *format*), so it is not a CSRF token, and a JSON body sent as `text/plain` is a CORS simple request with no preflight. The issue is fixed in 1.0.7. All three SSE endpoints validate the request `Origin` against `ALLOWED_HOSTS` (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require `Content-Type: application/json` (415 otherwise), closing the `text/plain` simple-request bypass. As a workaround, disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.
A Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) exists in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware version V1.06.01. This flaw allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, potentially granting access to privileged management functions.
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the device by tricking an authenticated user into visiting a malicious website.This issue has been fixed in firmware version 1.1.0.651412
Subscriptions for WooCommerce plugin versions before 2.0.3 contain a missing authorization vulnerability that allows logged-in customers to cancel their own active subscriptions via crafted requests without proper security token verification.
WPLP Cookie Consent WordPress plugin versions before 4.4.4 contain a Cross-Site Request Forgery (CSRF) vulnerability. The plugin does not perform CSRF or capability checks when processing bulk actions on its administration screens and fails to restrict actions to its own records. This allows an attacker to craft a request that can cause a logged-in administrator to permanently delete arbitrary posts and pages.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the J2Store extension for Joomla affecting versions 1.0.0 through 3.3.22, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. The flaw allows an attacker to forge requests during a victim's active checkout session to silently overwrite billing or shipping addresses before order confirmation or tamper with saved profile addresses. Exploitation requires user interaction and executes with the victim's session privileges, without cross-account data access.
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie in state and reuses the same cookie-bearing serialization for persisted state, public API responses, and WebSocket state updates. Any client that can reach the published Mousehole port can read cookie-bearing state, connect to WebSocket state updates, replace the stored cookie, or force MAM update side effects. The deployment examples publish port 5010 broadly with Docker's `5010:5010` syntax, which can make the issue reachable on mixed-trust LAN/VPN interfaces. Version 0.4.0 patches the issue.
CVE-2026-80380 is a high-severity cross-site request forgery (CSRF) vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. This flaw could allow a remote attacker to perform unauthorized actions by tricking an authenticated user into submitting a forged request. The vulnerability impacts the integrity of the system but does not affect confidentiality. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the SP Property extension for Joomla versions 1.0.0 through 4.1.3. The vulnerability affects the property booking and agent contact form submission endpoints, which process POST requests without verifying Joomla session anti-CSRF tokens. This could allow an attacker to perform unauthorized actions on behalf of a logged-in user.
CVE-2026-78084 is a medium severity vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The issue involves missing access control and lack of CSRF token validation in the gallery image management controller, allowing unauthorized users to perform file removal with arbitrary paths or upload unverified file types.
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.