OpenEMR versions prior to 8.3.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the pos_checkout_ippf.php interface. This flaw allows state-changing operations such as voiding transactions or regenerating invoice counters through GET requests without proper CSRF token validation. The conditional form_checksum integrity check can be bypassed when a specific parameter is omitted, enabling an attacker to force an authenticated billing user to perform unauthorized actions. This vulnerability affects financial and audit records integrity. The issue is resolved in OpenEMR version 8.3.0.
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.
The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
SharpEmu versions up to 0.0.3-release.3 are vulnerable due to missing authentication on its debugger frontend HTTP API running on localhost. This API lacks validation of critical headers and accepts cross-origin requests, allowing attackers with local network access to perform debugger operations, launch executables, and initiate outbound connections. The vulnerability is fixed in version 0.0.3-release.3-patch.1.
CGI versions prior to 5.00 for Perl contain a cross-site request forgery (CSRF) vulnerability. The software allows certain parameters (POSTDATA, PUTDATA, PATCHDATA, and XForms:Model) to be set from query strings or form fields, which can be exploited by a malicious cross-site HTML form to send forged requests. This occurs because CGI cannot distinguish between client-sent values and the actual request body, enabling unauthorized actions without requiring CORS preflight checks.
A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2026-63433 is a Cross-Site Request Forgery (CSRF) vulnerability in franklioxygen MyTube versions prior to 1.10.6. The issue arises because the CSRF protection middleware incorrectly exempts requests based solely on the presence of an x-api-key header or Authorization: ApiKey value without validating the API key. When combined with permissive CORS settings, an attacker can trick an authenticated administrator into sending unauthorized state-changing requests, bypassing CSRF token validation. This can lead to destructive administrative actions such as deleting media or changing subscriptions. The vulnerability is fixed in version 1.10.6.
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.
Chamilo LMS versions prior to 2.0.1 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in certain actions that modify the database without proper token validation. This allows an attacker to trick an authenticated administrator or HR user into performing unauthorized changes to skill records, profiles, or skill-gradebook associations. The vulnerability is fixed in version 2.0.1.
CVE-2026-107262 is a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Advanced Filesystem module affecting versions from 0.0.0 up to but not including 1.0.28. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user without their consent. The issue has been fixed in version 1.0.28.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-61671 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.7 allow authenticated users to bypass ownership checks on various CRUD operations, exposing sensitive personal and financial data. Additionally, some control modules lack proper CSRF protections, enabling attackers to perform unauthorized state-changing actions via victim sessions. The issue is fixed in version 3.8.7.
CVE-2026-5702 is a Cross-Site Request Forgery (CSRF) vulnerability in the SABBATIC application. It allows an attacker to trick an authenticated user into performing unauthorized actions by clicking a malicious link or loading a crafted page that sends unauthorized requests to the vulnerable endpoint. The vulnerability requires user interaction and low privileges but can lead to unauthorized state-changing requests.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Photo Album Plus WordPress plugin versions before 9.3.04.004. The plugin fails to verify the origin or a security token for a comment-management request, enabling attackers to trick logged-in users with comment-moderation rights into deleting photo comments by loading a crafted page.
CVE-2026-115300 is a Cross-Site Request Forgery (CSRF) vulnerability in the Contact Form by Supsystic WordPress plugin versions before 1.11.1. The flaw allows attackers to trick logged-in administrators into sending forged requests that bulk-delete captured form submissions and wipe form statistics. This can result in permanent loss of stored contact leads and analytics data.