Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,003

Export CSV
CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Back-office Default Twig Template
CVE-2026-116052

LinkStackOrg LinkStack cross-site request forgery

A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linkstack Linkstackorg
Products
Linkstack Linkstack
CVE-2026-119426

phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyadmin
Products
Phpmyadmin
CVE-2026-118266

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Labstack
Products
Echo
CVE-2015-20129

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Crushftp
Products
Crushftp
CVE-2026-117536

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Redaxo
Products
Core Redaxo
CVE-2026-114719

roundcubemail: roundcubemail: CSRF validation bypass via markasjunk plugin

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail
CVE-2026-75779

ASUS Router Firmware OS Command Injection via CSRF Enables Privileged Command Execution

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed
Vendors
Asus
Products
Router
CVE-2026-116880

Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Semantic-mediawiki
Products
Semantic Mediawiki
CVE-2026-116210

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Webasyst
Products
Webasyst-framework
CVE-2026-115299

Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Contact Form By Supsystic
CVE-2026-115300

Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Contact Form By Supsystic
CVE-2026-107262

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Advanced Filesystem
CVE-2026-110983

WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wppa
Products
Wp Photo Album Plus Wp Photo Album Plus
CVE-2026-27062

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-65566

WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-119466

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61671

WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Labredescefetrj
Products
Wegia
CVE-2026-45141

Chamilo LMS: CSRF in destructive skill-management AJAX actions

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token()` validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Chamilo
Products
Chamilo Lms