# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Masa CMS CSRF in site bundle creation allows unauthorized site data export](https://agentprime.io/advisories/CVE-2026-40326.md)
  `CVE-2026-40326` · CVE record: MasaCMS MasaCMS · CVSS 7.1 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content](https://agentprime.io/advisories/CVE-2026-40325.md)
  `CVE-2026-40325` · CVE record: MasaCMS MasaCMS · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content](https://agentprime.io/advisories/CVE-2026-40309.md)
  `CVE-2026-40309` · CVE record: MasaCMS MasaCMS · CVSS 7.2 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Masa CMS CSRF in user address management allows unauthorized address changes](https://agentprime.io/advisories/CVE-2026-40174.md)
  `CVE-2026-40174` · CVE record: MasaCMS MasaCMS · CVSS 7.1 High · Not analysed yet · Published 6 May 2026 · Tags: Cross-site request forgery (CSRF)
- [HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.](https://agentprime.io/advisories/CVE-2025-31957.md)
  `CVE-2025-31957` · CVE record: HCL Software BigFix Service Management (SM) · CVSS 2.6 Low · Not analysed yet · Published 6 May 2026 · Tags: Cross-site request forgery (CSRF)
- [AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content](https://agentprime.io/advisories/GHSA-jw8g-5j46-44rp.md)
  `GHSA-jw8g-5j46-44rp`, `CVE-2026-43877`, `PKSA-7rzh-pwkp-t841` · Packagist `wwbn/avideo`: affected `<=29.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site request forgery (CSRF)
- [JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)](https://agentprime.io/advisories/GHSA-m68r-v472-jgq9.md)
  `GHSA-m68r-v472-jgq9`, `BIT-jupyterhub-2026-40864`, `CVE-2026-40864`, `PYSEC-2026-2189` · PyPI `jupyterhub`: affected `>=4.1.0, <5.4.5`, fixed in `5.4.5` · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter](https://agentprime.io/advisories/CVE-2026-6702.md)
  `CVE-2026-6702` · CVE record: foux Publish 2 Ping.fm · CVSS 6.1 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site request forgery (CSRF)
- [DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-6700.md)
  `CVE-2026-6700` · CVE record: xavortm DX Sources · CVSS 4.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site request forgery (CSRF)
- [addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page](https://agentprime.io/advisories/CVE-2026-6701.md)
  `CVE-2026-6701` · CVE record: kazunii addfreespace · CVSS 4.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation](https://agentprime.io/advisories/CVE-2026-3140.md)
  `CVE-2026-3140` · CVE record: davidvongries Ultimate Dashboard – Custom WordPress Dashboard · CVSS 4.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor](https://agentprime.io/advisories/CVE-2026-3772.md)
  `CVE-2026-3772` · CVE record: benjaminprojas WP Editor · CVSS 8.8 High · Not analysed yet · Published 1 May 2026 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.](https://agentprime.io/advisories/CVE-2026-36960.md)
  `CVE-2026-36960` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.](https://agentprime.io/advisories/CVE-2026-36956.md)
  `CVE-2026-36956` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send](https://agentprime.io/advisories/GHSA-rw74-vc9h-534j.md)
  `GHSA-rw74-vc9h-534j`, `CVE-2026-41663`, `PKSA-j859-828r-5ckz` · Packagist `admidio/admidio`: affected `<5.0.9`, fixed in `5.0.9` · CVSS 3.5 Low · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [CKAN has CSRF exemption primed by anonymous requests](https://agentprime.io/advisories/GHSA-mcvf-jxcw-vj73.md)
  `GHSA-mcvf-jxcw-vj73`, `CVE-2026-41255`, `PYSEC-2026-2418` · PyPI `ckan`: affected `>=2.10.0, <2.10.10 || >=2.11.0, <2.11.5`, fixed in `2.10.10`, `2.11.5` · CVSS 6.1 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [VideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2018-25310.md)
  `CVE-2018-25310` · CVE record: VideoFlow Ltd. VideoFlow Digital Video Protection · CVSS 5.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer](https://agentprime.io/advisories/CVE-2018-25298.md)
  `CVE-2018-25298` · CVE record: Merge Merge PACS · CVSS 6.9 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-42645.md)
  `CVE-2026-42645` · CVE record: Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [code-projects Invoice System in Laravel cross-site request forgery](https://agentprime.io/advisories/CVE-2026-7108.md)
  `CVE-2026-7108` · CVE record: code-projects Invoice System in Laravel · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/setting…](https://agentprime.io/advisories/CVE-2026-38934.md)
  `CVE-2026-38934` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions](https://agentprime.io/advisories/GHSA-m2m6-cff5-3w7c.md)
  `GHSA-m2m6-cff5-3w7c`, `CVE-2026-42190` · npm `rwsdk`: affected `>=1.0.0-beta.50, <1.2.3`, fixed in `1.2.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action](https://agentprime.io/advisories/CVE-2026-3565.md)
  `CVE-2026-3565` · CVE record: taqnix Taqnix · CVSS 4.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation](https://agentprime.io/advisories/CVE-2026-41317.md)
  `CVE-2026-41317` · CVE record: frappe press · CVSS 6.6 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode](https://agentprime.io/advisories/GHSA-2xp4-qhr4-xqm2.md)
  `GHSA-2xp4-qhr4-xqm2` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [SenseLive X3050 Cross-Site request forgery](https://agentprime.io/advisories/CVE-2026-27841.md)
  `CVE-2026-27841` · CVE record: SenseLive X3050 · CVSS 8.4 High · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Hackage CSRF vulnerability](https://agentprime.io/advisories/CVE-2026-40471.md)
  `CVE-2026-40471` · CVE record · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS](https://agentprime.io/advisories/GHSA-rhf7-wvw3-vjvm.md)
  `GHSA-rhf7-wvw3-vjvm`, `CVE-2026-42091`, `GO-2026-5625` · Go `github.com/patrickhener/goshs` and 1 more: affected `<=1.1.4`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in GitLab](https://agentprime.io/advisories/CVE-2026-4922.md)
  `CVE-2026-4922` · CVE record: GitLab GitLab · CVSS 8.1 High · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-58922.md)
  `CVE-2025-58922` · CVE record: ThemeFusion Avada · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection](https://agentprime.io/advisories/GHSA-2r2p-4cgf-hv7h.md)
  `GHSA-2r2p-4cgf-hv7h` · npm `engramx`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 4.0, no score published · Not analysed yet · Published 22 Apr 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-942, CWE-1188
- [DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update](https://agentprime.io/advisories/CVE-2026-4138.md)
  `CVE-2026-4138` · CVE record: nofearinc DX Unanswered Comments · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page](https://agentprime.io/advisories/CVE-2026-6294.md)
  `CVE-2026-6294` · CVE record: byybora Google PageRank Display · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-4121.md)
  `CVE-2026-4121` · CVE record: ksolves Kcaptcha · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form](https://agentprime.io/advisories/CVE-2026-4090.md)
  `CVE-2026-4090` · CVE record: ravster Inquiry cart · CVSS 6.1 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update](https://agentprime.io/advisories/CVE-2026-4118.md)
  `CVE-2026-4118` · CVE record: tmarek Call To Action Plugin · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function](https://agentprime.io/advisories/CVE-2026-4139.md)
  `CVE-2026-4139` · CVE record: chsxf mCatFilter · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Fast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action](https://agentprime.io/advisories/CVE-2026-6396.md)
  `CVE-2026-6396` · CVE record: webarea Fast & Fancy Filter – 3F · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action](https://agentprime.io/advisories/CVE-2026-4140.md)
  `CVE-2026-4140` · CVE record: anzia Ni WooCommerce Order Export · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [TextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-4133.md)
  `CVE-2026-4133` · CVE record: textp2p TextP2P Texting Widget · CVSS 4.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter](https://agentprime.io/advisories/CVE-2026-4131.md)
  `CVE-2026-4131` · CVE record: sphex1987 WP Responsive Popup + Optin · CVSS 6.1 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable](https://agentprime.io/advisories/CVE-2026-41194.md)
  `CVE-2026-41194` · CVE record: freescout-help-desk freescout · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints](https://agentprime.io/advisories/GHSA-78mf-482w-62qj.md)
  `GHSA-78mf-482w-62qj`, `CVE-2026-34403`, `GO-2026-5210` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260316053337-1a9cd29a3082`, fixed in `1.9.10-0.20260316053337-1a9cd29a3082` · CVSS 5.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF), CWE-1385
- [Other issue in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-6777.md)
  `CVE-2026-6777` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF), Denial of service, CWE-20
- [Mitigation bypass in the DOM: postMessage component](https://agentprime.io/advisories/CVE-2026-6755.md)
  `CVE-2026-6755` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF).](https://agentprime.io/advisories/CVE-2026-31014.md)
  `CVE-2026-31014` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [ComfyUI server.py create_origin_only_middleware cross-site request forgery](https://agentprime.io/advisories/CVE-2026-6589.md)
  `CVE-2026-6589` · CVE record: ComfyUI · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation](https://agentprime.io/advisories/GHSA-5w6h-pjw6-wvc6.md)
  `GHSA-5w6h-pjw6-wvc6`, `CVE-2026-40948`, `PYSEC-2026-2369` · PyPI `apache-airflow-providers-keycloak`: affected `>=0.0.1, <0.7.0`, fixed in `0.7.0` · CVSS 5.4 Medium · Not analysed yet · Published 18 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion](https://agentprime.io/advisories/CVE-2026-40581.md)
  `CVE-2026-40581` · CVE record: ChurchCRM CRM · CVSS 8.1 High · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/GHSA-xw5c-jc7x-gf75.md)
  `GHSA-xw5c-jc7x-gf75`, `CVE-2026-40458` · Maven `org.pac4j:pac4j-core`: affected `<5.7.10 || >=6.0.0-RC1, <6.4.1`, fixed in `5.7.10`, `6.4.1` · CVSS 7.0 High · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Mattermost doesn't validate CSRF tokens on an authentication endpoint](https://agentprime.io/advisories/GHSA-m7cf-4gh2-v4qg.md)
  `GHSA-m7cf-4gh2-v4qg`, `CVE-2026-28741`, `GO-2026-5495` · Go `github.com/mattermost/mattermost/server/v8`: affected `>=8.0.0-20250721062209-4952acea88ce, <8.0.0-20260220133927-c29cf05d40f8 || >=11.3.0-rc1, <11.3.3 || >=11.4.0-rc1, <11.4.3 || >=11.5.0-rc1, <11.5.0`, fixed in `8.0.0-20260220133927-c29cf05d40f8`, `11.3.3`, `11.4.3`, `11.5.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-6451.md)
  `CVE-2026-6451` · CVE record: tholstkabelbwde Plugin: CMS für Motorrad Werkstätten · CVSS 4.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Authlib: Cross-site request forging when using cache](https://agentprime.io/advisories/GHSA-jj8c-mmj3-mmgv.md)
  `GHSA-jj8c-mmj3-mmgv`, `CVE-2026-41425`, `PYSEC-2026-25` · PyPI `authlib`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 5.4 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-15635.md)
  `CVE-2025-15635` · CVE record: ZAYTECH Smart Online Order for Clover · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-53444.md)
  `CVE-2025-53444` · CVE record: DeluxeThemes Userpro · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion](https://agentprime.io/advisories/CVE-2026-1852.md)
  `CVE-2026-1852` · CVE record: woobeewoo Product Pricing Table by WooBeWoo · CVSS 6.1 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-40764.md)
  `CVE-2026-40764` · CVE record: Syed Balkhi Contact Form by WPForms · CVSS 8.1 High · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-4091.md)
  `CVE-2026-4091` · CVE record: faridsaniee OPEN-BRAIN · CVSS 6.1 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action](https://agentprime.io/advisories/CVE-2026-4002.md)
  `CVE-2026-4002` · CVE record: petjeaf Petje.af · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter](https://agentprime.io/advisories/CVE-2026-6293.md)
  `CVE-2026-6293` · CVE record: udamadu Inquiry form to posts or pages · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA0LTE1VDA2OjQ2OjE4Ljg5MDAwMFoiLCJDVkUtMjAyNi02MjkzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTA1LTA3VDA3OjQwOjI3LjA2NTAwMFoiLCJDVkUtMjAyNS02ODYwNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTA1LTA3VDA3OjQwOjI3LjA2NTAwMFoiLCJDVkUtMjAyNS02ODYwNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.