agentprime: Cross-site request forgery (CSRF)Every new Cross-site request forgery (CSRF) Advisory and CVE.https://agentprime.io/CVE-2026-103938: OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operationshttps://agentprime.io/advisories/CVE-2026-103938/https://agentprime.io/advisories/CVE-2026-103938/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:56:59 GMTCVECVE-2026-73099: Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overridehttps://agentprime.io/advisories/CVE-2026-73099/https://agentprime.io/advisories/CVE-2026-73099/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 11:50:02 GMTCVEcriticalCVE-2026-122151: Presenton User Configuration user-config JSON.parse cross-site request forgeryhttps://agentprime.io/advisories/CVE-2026-122151/https://agentprime.io/advisories/CVE-2026-122151/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 01:00:28 GMTCVECVE-2026-122144: nliautaud pico-content-editor cross-site request forgeryhttps://agentprime.io/advisories/CVE-2026-122144/https://agentprime.io/advisories/CVE-2026-122144/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 00:30:21 GMTCVECVE-2025-71454: vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tamperinghttps://agentprime.io/advisories/CVE-2025-71454/https://agentprime.io/advisories/CVE-2025-71454/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:36:43 GMTCVECVE-2026-92704: SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionhttps://agentprime.io/advisories/CVE-2026-92704/https://agentprime.io/advisories/CVE-2026-92704/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 15:24:16 GMTCVECVE-2026-105296: Cross-site request forgery in Akeeba Ltd. Akeeba Backup for Joomla! and othershttps://agentprime.io/advisories/CVE-2026-105296/https://agentprime.io/advisories/CVE-2026-105296/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 04:46:52 GMTCVECVE-2026-120640: CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fieldshttps://agentprime.io/advisories/CVE-2026-120640/https://agentprime.io/advisories/CVE-2026-120640/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:40:33 GMTCVECVE-2026-110288: Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Consolehttps://agentprime.io/advisories/CVE-2026-110288/https://agentprime.io/advisories/CVE-2026-110288/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 22:50:39 GMTCVECVE-2026-63433: MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Valuehttps://agentprime.io/advisories/CVE-2026-63433/https://agentprime.io/advisories/CVE-2026-63433/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:52:42 GMTCVECVE-2026-121451: AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFhttps://agentprime.io/advisories/CVE-2026-121451/https://agentprime.io/advisories/CVE-2026-121451/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:17:01 GMTCVECVE-2026-103420: Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5https://agentprime.io/advisories/CVE-2026-103420/https://agentprime.io/advisories/CVE-2026-103420/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:24:37 GMTCVECVE-2026-120249: Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routeshttps://agentprime.io/advisories/CVE-2026-120249/https://agentprime.io/advisories/CVE-2026-120249/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 00:57:13 GMTCVECVE-2026-120207: Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routeshttps://agentprime.io/advisories/CVE-2026-120207/https://agentprime.io/advisories/CVE-2026-120207/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 17:25:54 GMTCVECVE-2026-120206: Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actionshttps://agentprime.io/advisories/CVE-2026-120206/https://agentprime.io/advisories/CVE-2026-120206/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 17:25:54 GMTCVEAdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgeryhttps://agentprime.io/advisories/GHSA-wm25-49w3-5qrg/https://agentprime.io/advisories/GHSA-wm25-49w3-5qrg/adminneo-org/adminneo <5.5.1, fixed in 5.5.1. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:51:29 GMTPackagistadminneo-org/adminneoCVE-2026-61826: Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-61826/https://agentprime.io/advisories/CVE-2026-61826/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:12:43 GMTCVEcriticalCVE-2026-119466: WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119466/https://agentprime.io/advisories/CVE-2026-119466/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 16:16:28 GMTCVECVE-2026-65566: WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-65566/https://agentprime.io/advisories/CVE-2026-65566/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 16:15:59 GMTCVECVE-2026-45141: Chamilo LMS: CSRF in destructive skill-management AJAX actionshttps://agentprime.io/advisories/CVE-2026-45141/https://agentprime.io/advisories/CVE-2026-45141/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:30:44 GMTCVECVE-2026-112374: FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login APIhttps://agentprime.io/advisories/CVE-2026-112374/https://agentprime.io/advisories/CVE-2026-112374/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 12:10:37 GMTCVECVE-2026-119426: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sqlhttps://agentprime.io/advisories/CVE-2026-119426/https://agentprime.io/advisories/CVE-2026-119426/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:30:55 GMTCVECVE-2026-119407: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parametershttps://agentprime.io/advisories/CVE-2026-119407/https://agentprime.io/advisories/CVE-2026-119407/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:30:44 GMTCVECVE-2026-107262: Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217https://agentprime.io/advisories/CVE-2026-107262/https://agentprime.io/advisories/CVE-2026-107262/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:09:56 GMTCVECVE-2026-114541: Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240https://agentprime.io/advisories/CVE-2026-114541/https://agentprime.io/advisories/CVE-2026-114541/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:09:28 GMTCVECVE-2026-118543: Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258https://agentprime.io/advisories/CVE-2026-118543/https://agentprime.io/advisories/CVE-2026-118543/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:09:09 GMTCVECVE-2026-118558: Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263https://agentprime.io/advisories/CVE-2026-118558/https://agentprime.io/advisories/CVE-2026-118558/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:09:03 GMTCVECVE-2026-118570: Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283https://agentprime.io/advisories/CVE-2026-118570/https://agentprime.io/advisories/CVE-2026-118570/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:08:44 GMTCVECVE-2026-61671: WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classeshttps://agentprime.io/advisories/CVE-2026-61671/https://agentprime.io/advisories/CVE-2026-61671/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 21:21:02 GMTCVECVE-2026-27062: WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-27062/https://agentprime.io/advisories/CVE-2026-27062/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 14:38:48 GMTCVECVE-2026-116399: WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116399/https://agentprime.io/advisories/CVE-2026-116399/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 13:54:04 GMTCVECVE-2026-5702: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC applicationhttps://agentprime.io/advisories/CVE-2026-5702/https://agentprime.io/advisories/CVE-2026-5702/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 11:17:09 GMTCVECVE-2026-110983: WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRFhttps://agentprime.io/advisories/CVE-2026-110983/https://agentprime.io/advisories/CVE-2026-110983/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:00:25 GMTCVECVE-2026-115300: Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRFhttps://agentprime.io/advisories/CVE-2026-115300/https://agentprime.io/advisories/CVE-2026-115300/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:00:22 GMTCVECVE-2026-115299: Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRFhttps://agentprime.io/advisories/CVE-2026-115299/https://agentprime.io/advisories/CVE-2026-115299/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:00:21 GMTCVEEcho has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodhttps://agentprime.io/advisories/GHSA-r7w9-592q-9vg4/https://agentprime.io/advisories/GHSA-r7w9-592q-9vg4/github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:53:36 GMTGogithub.com/labstack/echo/v4github.com/labstack/echo/v5CVE-2026-92797: Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameterhttps://agentprime.io/advisories/CVE-2026-92797/https://agentprime.io/advisories/CVE-2026-92797/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 07:48:28 GMTCVECVE-2026-111120: VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Taskhttps://agentprime.io/advisories/CVE-2026-111120/https://agentprime.io/advisories/CVE-2026-111120/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:45:10 GMTCVECVE-2026-113486: Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRFhttps://agentprime.io/advisories/CVE-2026-113486/https://agentprime.io/advisories/CVE-2026-113486/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:00:25 GMTCVECVE-2026-113485: Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRFhttps://agentprime.io/advisories/CVE-2026-113485/https://agentprime.io/advisories/CVE-2026-113485/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:00:25 GMTCVECVE-2015-20129: CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/https://agentprime.io/advisories/CVE-2015-20129/https://agentprime.io/advisories/CVE-2015-20129/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 02:03:14 GMTCVECVE-2026-116863: WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116863/https://agentprime.io/advisories/CVE-2026-116863/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:56:41 GMTCVEcriticalCVE-2026-117536: REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-117536/https://agentprime.io/advisories/CVE-2026-117536/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 10:59:31 GMTCVECVE-2026-117534: REDAXO before 5.21.3 CSRF in Article History Pluginhttps://agentprime.io/advisories/CVE-2026-117534/https://agentprime.io/advisories/CVE-2026-117534/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 10:59:30 GMTCVECVE-2026-116895: REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameterhttps://agentprime.io/advisories/CVE-2026-116895/https://agentprime.io/advisories/CVE-2026-116895/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 10:59:24 GMTCVECVE-2026-116880: Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actionshttps://agentprime.io/advisories/CVE-2026-116880/https://agentprime.io/advisories/CVE-2026-116880/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 10:23:32 GMTCVECVE-2026-102787: Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5https://agentprime.io/advisories/CVE-2026-102787/https://agentprime.io/advisories/CVE-2026-102787/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 09:32:09 GMTCVECVE-2026-116839: Cross-site request forgery in Ubiquiti Inc airMAX Mhttps://agentprime.io/advisories/CVE-2026-116839/https://agentprime.io/advisories/CVE-2026-116839/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 00:51:23 GMTCVECVE-2026-116838: Cross-site request forgery in Ubiquiti Inc airMAX Mhttps://agentprime.io/advisories/CVE-2026-116838/https://agentprime.io/advisories/CVE-2026-116838/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 00:48:17 GMTCVECVE-2026-77058: Cross-Site Request Forgery (CSRF) in boneIOhttps://agentprime.io/advisories/CVE-2026-77058/https://agentprime.io/advisories/CVE-2026-77058/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 14:45:59 GMTCVE