Avenwu Whistle versions 2.9.90 and earlier are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform malicious API calls. This can lead to the execution of arbitrary code on the victim's machine. The vulnerability is fixed in version 2.10.8.