Cross-site request forgery (CSRF).

OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution

• Cross-site request forgery (CSRF)

<2026.2.14 · fixed in 2026.2.14

newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery

• newbee-ltd newbee-mall
• Cross-site request forgery (CSRF)
• Broken access control

Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion

• webguyio Dam Spam
• Cross-site request forgery (CSRF)

Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update

• jamesits Keybase.io Verification
• Cross-site request forgery (CSRF)

WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation

• brikou WP Plugin Info Card
• Cross-site request forgery (CSRF)

OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

• Cross-site request forgery (CSRF)

<=2026.1.24-3 · no fixed version yet

PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module.

• Cross-site request forgery (CSRF)

Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

• IBM DB2 Recovery Expert for LUW
• Cross-site request forgery (CSRF)

Multiple Vulnerabilities in IBM Concert Software.

• IBM Concert
• Cross-site request forgery (CSRF)

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0.

• Cross-site request forgery (CSRF)

WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update

• dmitritechs WP Quick Contact Us
• Cross-site request forgery (CSRF)

MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update

• antevenio MDirector Newsletter WordPress Plugin
• Cross-site request forgery (CSRF)

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery

• LatePoint – Calendar Booking Plugin for Appointments and Events
• Cross-site request forgery (CSRF)

SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion

• sourcez SEATT: Simple Event Attendance
• Cross-site request forgery (CSRF)

Cross-Site Request Forgery (CSRF) in FastGPT

• labring FastGPT
• Cross-site request forgery (CSRF)

Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who in…

• Broken access control
• Cross-site request forgery (CSRF)

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

• AVideo Platform
• Cross-site request forgery (CSRF)
• CWE-640

FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)

• Flexera Software FlexNet Publisher
• Cross-site request forgery (CSRF)

Cross-site request forgery in Google Chrome

• Google Chrome
• Information disclosure
• Cross-site request forgery (CSRF)

MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update

• messagemetric MMA Call Tracking
• Cross-site request forgery (CSRF)

Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment

• kanboard
• Cross-site request forgery (CSRF)

unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

• Cross-site request forgery (CSRF)
• Information disclosure

<1.8.2 · fixed in 1.8.2

PlaciPy is Missing CSRF Protection on State-Changing Endpoints

• Praskla-Technology assessment-placipy
• Cross-site request forgery (CSRF)

Cross-site request forgery in Yokogawa Electric Corporation FAST/TOOLS

• Yokogawa Electric Corporation FAST/TOOLS
• Cross-site request forgery (CSRF)

TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update

• arkapravamajumder TITLE ANIMATOR
• Cross-site request forgery (CSRF)

Wing FTP Server < 6.2.7 - Cross-site Request Forgery

• Wing FTP Server
• Cross-site request forgery (CSRF)

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

• Bdtask Business Live Chat Software
• Cross-site request forgery (CSRF)

Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions

• codesnippetspro Code Snippets
• Cross-site request forgery (CSRF)

Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution

• EDIMAX Technology EW-7438RPn Mini
• Cross-site request forgery (CSRF)

HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)

• HRSALE
• Cross-site request forgery (CSRF)

Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)

• Exagate Sysguard 6001
• Cross-site request forgery (CSRF)

P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)

• P5 FNIP-8x16A
• Cross-site request forgery (CSRF)

Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s (breadcrumb) param…

• Cross-site request forgery (CSRF)

IBM Operations Analytics - Log Analysis is affected by CSRF Token Replay Attack

• IBM Operations Analytics - Log Analysis
• Cross-site request forgery (CSRF)

lcg0124 BootDo cross-site request forgery

• lcg0124 BootDo
• Cross-site request forgery (CSRF)
• Broken access control

Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)

• EDIMAX Technology Co., Ltd. EW-7438RPn Mini
• Cross-site request forgery (CSRF)

Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)

• Maian Media Maian Support Helpdesk
• Cross-site request forgery (CSRF)

Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

• Cross-site request forgery (CSRF)

<1.12.0 · fixed in 1.12.0

Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

• Cross-site request forgery (CSRF)

<1.19.0 · fixed in 1.19.0

Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions

• Shenzhen Tenda Technology Co., Ltd. Tenda AC7
• Cross-site request forgery (CSRF)

Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions

• gunet openeclass
• Cross-site request forgery (CSRF)

WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability

• Blair Williams ThirstyAffiliates
• Cross-site request forgery (CSRF)

WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability

• Stiofan UsersWP
• Cross-site request forgery (CSRF)

WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability

• themelooks Enter Addons
• Cross-site request forgery (CSRF)

WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

• wp.insider Simple Membership WP user Import
• Cross-site request forgery (CSRF)

WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

• Copyscape Premium
• Cross-site request forgery (CSRF)

WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability

• Brainstorm Force Sigmize
• Cross-site request forgery (CSRF)

WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

• magepeopleteam WpEvently
• Cross-site request forgery (CSRF)

Cross-site request forgery in ELECOM CO.,LTD. WRC-X1500GS-B and others

• ELECOM CO.,LTD. WRC-X1500GS-B
• ELECOM CO.,LTD. WRC-X1500GSA-B
• Cross-site request forgery (CSRF)

Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

• getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
• Cross-site request forgery (CSRF)

PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)

• polarnl PolarLearn
• Cross-site request forgery (CSRF)

Tuleap is missing CSRF protection in the Overview inconsistent items

• Enalean tuleap
• Cross-site request forgery (CSRF)

Five Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF

• Five Star Restaurant Reservations
• Cross-site request forgery (CSRF)

SourceCodester Medical Certificate Generator App cross-site request forgery

• SourceCodester Medical Certificate Generator App
• Cross-site request forgery (CSRF)
• Broken access control

Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change

• ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
• Cross-site request forgery (CSRF)

Navigate CMS 2.8.7 - Cross-Site Request Forgery

• Naviwebs S.C. Navigate CMS
• Cross-site request forgery (CSRF)

Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery

• Adikiss Sistem Informasi Pengumuman Kelulusan Online
• Cross-site request forgery (CSRF)

Sickbeard 0.1 - Cross-Site Request Forgery

• midgetspy Sickbeard
• Cross-site request forgery (CSRF)

birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL

• birkir prime
• Cross-site request forgery (CSRF)

Liman 0.7 - Cross-Site Request Forgery (Change Password)

• salihciftci Liman
• Cross-site request forgery (CSRF)