Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-103938 CVE record

CVSS 7.1 High

OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
- openemr
- Cross-site request forgery (CSRF)
Not analysed yet 5 Nov 2026
CVE-2026-73099 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
- Apache Software Foundation Apache Juneau
- Cross-site request forgery (CSRF)
Not analysed yet 5 Nov 2026
CVE-2026-122151 CVE record

CVSS 5.3 Medium

Presenton User Configuration user-config JSON.parse cross-site request forgery
- Presenton
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2026-122144 CVE record

CVSS 5.3 Medium

nliautaud pico-content-editor cross-site request forgery
- nliautaud pico-content-editor
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 5 Nov 2026
CVE-2025-71454 CVE record

CVSS 6.9 Medium

vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
- vtenext
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2026
CVE-2026-92704 CVE record

CVSS 8.3 High

SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
- sharpemu
- Authentication bypass
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2026
CVE-2026-105296 CVE record

CVSS 5.1 Medium

Cross-site request forgery in Akeeba Ltd. Akeeba Backup for Joomla! and others
- Akeeba Ltd. Akeeba Backup for Joomla!
- Akeeba Ltd. Akeeba Backup for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 4 Nov 2026
CVE-2026-120640 CVE record

CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields
- Cross-site request forgery (CSRF)
Not analysed yet 3 Nov 2026
CVE-2026-110288 CVE record

CVSS 5.3 Medium

Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
- GitHub Enterprise Server
- Cross-site request forgery (CSRF)
Not analysed yet 3 Nov 2026
CVE-2026-63433 CVE record

CVSS 6.8 Medium

MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
- franklioxygen MyTube
- Cross-site request forgery (CSRF)
Not analysed yet 3 Nov 2026
CVE-2026-121451 CVE record

CVSS 8.7 High

AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF
- amir1376 ab-download-manager
- Cross-site request forgery (CSRF)
Not analysed yet 3 Nov 2026
CVE-2026-103420 CVE record

CVSS 7.2 High

Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
- php-web-design.com StageIt extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 2 Nov 2026
CVE-2026-120249 CVE record

CVSS 6.9 Medium

Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
- Thelia Back-office Default Twig Template
- Cross-site request forgery (CSRF)
Not analysed yet 1 Nov 2026
CVE-2026-120207 CVE record

CVSS 7.0 High

Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
- Thelia Page Module
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2026
CVE-2026-120206 CVE record

CVSS 5.9 Medium

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
- Thelia
- Thelia Core
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2026
adminneo-org/adminneo Packagist

CVSS 6.8 Medium

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
- Weak cryptography or TLS
- Cross-site request forgery (CSRF)
<5.5.1 · fixed in 5.5.1

GHSA-wm25-49w3-5qrg · CVE-2026-96629 Not analysed yet 30 Oct 2026
CVE-2026-61826 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
- morpheus65535 bazarr
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 30 Oct 2026
CVE-2026-119466 CVE record

CVSS 5.4 Medium

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
- WPExperts APIExperts Square for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-65566 CVE record

CVSS 8.8 High

WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
- Meow Apps AI Engine
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-45141 CVE record

CVSS 6.5 Medium

Chamilo LMS: CSRF in destructive skill-management AJAX actions
- chamilo-lms
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-112374 CVE record

CVSS 5.1 Medium

FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
- FOSSBilling
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-119426 CVE record

CVSS 7.7 High

phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
- phpMyAdmin
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-119407 CVE record

CVSS 7.1 High

Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
- element-hq element-web
- element-hq element-desktop
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-107262 CVE record

CVSS 5.3 Medium

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217
- Drupal Advanced Filesystem
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-114541 CVE record

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
- Drupal Frontend Editing
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-118543 CVE record

Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
- Drupal Commerce Core
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-118558 CVE record

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263
- Drupal Commerce Stripe
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-118570 CVE record

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
- Drupal Fasttoggle
- Cross-site request forgery (CSRF)
Not analysed yet 30 Oct 2026
CVE-2026-61671 CVE record

CVSS 8.1 High

WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
- LabRedesCefetRJ WeGIA
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-27062 CVE record

CVSS 4.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
- WPFunnels
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-116399 CVE record

CVSS 8.8 High

WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
- InstaWP Connect
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-5702 CVE record

CVSS 4.8 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
- SABBATIC app
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-110983 CVE record

CVSS 4.3 Medium

WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
- WP Photo Album Plus
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-115300 CVE record

CVSS 4.3 Medium

Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
- Contact Form by Supsystic
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
CVE-2026-115299 CVE record

CVSS 5.4 Medium

Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
- Contact Form by Supsystic
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2026
github.com/labstack/echo/v4 +1 Go

CVSS 5.3 Medium

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
- Cross-site request forgery (CSRF)
<4.16.0 · fixed in 4.16.0

GHSA-r7w9-592q-9vg4 · CVE-2026-118266 Not analysed yet 28 Oct 2026
CVE-2026-92797 CVE record

CVSS 8.8 High

Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
- Memberpress
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2026
CVE-2026-111120 CVE record

CVSS 8.8 High

VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
- e4jvikwp VikRentCar Car Rental Management System
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2026
CVE-2026-113486 CVE record

CVSS 6.5 Medium

Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
- Media Library Assistant
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2026
CVE-2026-113485 CVE record

CVSS 6.5 Medium

Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
- Media Library Assistant
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2026
CVE-2015-20129 CVE record

CVSS 8.6 High

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
- CrushFTP
- Cross-site request forgery (CSRF)
Not analysed yet 28 Oct 2026
CVE-2026-116863 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
- Tribulant Software Newsletters
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-117536 CVE record

CVSS 8.6 High

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
- redaxo core
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-117534 CVE record

CVSS 5.1 Medium

REDAXO before 5.21.3 CSRF in Article History Plugin
- redaxo core
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-116895 CVE record

CVSS 5.1 Medium

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
- redaxo core
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-116880 CVE record

CVSS 7.1 High

Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions
- SemanticMediaWiki
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-102787 CVE record

CVSS 5.3 Medium

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
- phoca.cz Phoca Download extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-116839 CVE record

CVSS 7.1 High

Cross-site request forgery in Ubiquiti Inc airMAX M
- Ubiquiti Inc airMAX M
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-116838 CVE record

CVSS 8.8 High

Cross-site request forgery in Ubiquiti Inc airMAX M
- Ubiquiti Inc airMAX M
- Cross-site request forgery (CSRF)
Not analysed yet 27 Oct 2026
CVE-2026-77058 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery (CSRF) in boneIO
- boneIO
- Cross-site request forgery (CSRF)
Not analysed yet 26 Oct 2026
CVE-2026-116210 CVE record

CVSS 7.1 High

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
- Webasyst Framework
- Cross-site request forgery (CSRF)
Not analysed yet 26 Oct 2026
CVE-2026-97295 CVE record

CVSS 4.3 Medium

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability
- David Lingren Media LIbrary Assistant
- Cross-site request forgery (CSRF)
Not analysed yet 26 Oct 2026
CVE-2026-111841 CVE record

CVSS 8.8 High

WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- Aman FunnelKit Automations
- Cross-site request forgery (CSRF)
Not analysed yet 26 Oct 2026
CVE-2026-116204 CVE record

CVSS 7.2 High

YesWiki before 4.7.0 CSRF via despam Admin Action
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2026
CVE-2026-116052 CVE record

CVSS 5.3 Medium

LinkStackOrg LinkStack cross-site request forgery
- LinkStack
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 25 Oct 2026
CVE-2026-116072 CVE record

CVSS 5.3 Medium

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
- Docile-Alligator Infinity for Reddit
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2026
CVE-2026-115796 CVE record

CVSS 5.3 Medium

Tenda F6 Web Management cross-site request forgery
- Tenda F6
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 23 Oct 2026
CVE-2026-93631 CVE record

CVSS 7.1 High

Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
- Zimbra Collaboration Suite
- Cross-site request forgery (CSRF)
Not analysed yet 23 Oct 2026
CVE-2026-75779 CVE record

CVSS 8.6 High

OS command injection in ASUS Router
- ASUS Router
- Command injection
- Cross-site request forgery (CSRF)
Not analysed yet 23 Oct 2026
electron npm

CVSS 4.2 Medium

Electron: SameSite cookie restrictions are not applied to windows opened from links
- Cross-site request forgery (CSRF)
<42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.6 · fixed in 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6

GHSA-2p8c-gr87-2676 · CVE-2026-113796 Not analysed yet 22 Oct 2026