tag
Csrf
Sliver C2 MCP Server Unauthenticated CORS/Preflight Bypass (CVE-2026-34227)
Sliver's MCP server exposes an unauthenticated Server-Sent Events (SSE) interface on 127.0.0.1:8080 and responds to every request with Access-Control-Allow-Origin: . Because the underlying mcp-go library does not validate the request's Content-Type, a…
Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)
The Nhost CLI's local MCP server, used to let AI agents/tools manage a developer's Nhost project, has no inbound authentication and inherits a permissive Access-Control-Allow-Origin: CORS policy from the underlying mcp-go library. Because the server does not…
JupyterHub Cross-Origin Form POST XSRF Bypass (CVE-2026-40864)
JupyterHub's XSRF protection, reworked in 4.1.0, uses the browser-supplied Sec-Fetch-Mode header as an origin oracle to decide whether a request is same-origin and therefore exempt from token validation. The implementation incorrectly treats Sec-Fetch-Mode:…
Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290
The Joomla extension Page Builder CK exposes a controller method, browse.ajaxAddPicture, that accepts file uploads with a user-controlled destination path parameter (path) that is only passed through trim() — no whitelist, extension check, or…
Friendly Functions for Welcart WordPress Plugin CSRF (CVE-2026-1208)
The Friendly Functions for Welcart plugin's settings page fails to validate a nonce or verify request origin when processing settings updates, exposing a classic CSRF flaw. An unauthenticated attacker can craft an auto-submitting HTML form targeting the…
diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)
public/settingsprocess.php in diskover-community (<= 2.3.5) accepts sensitive configuration-changing POST requests without validating any CSRF token. An attacker can craft a self-submitting HTML form that, when opened by an authenticated administrator,…
Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862
Appsmith's TableWidgetV2 component (BasicCell.tsx) fails to sanitize user-supplied cell values when the column type is URL or Plain Text, rendering raw HTML/attributes directly as React children and allowing stored XSS. Because Appsmith's XSRF-TOKEN cookie is…
AdminPanel 4.0 CSRF File Deletion / Setup-Mode Reset — CVE-2026-30498
AdminPanel 4.0's delete.php endpoint performs a sensitive file-deletion action (deleting verifyPanel.php) via a simple GET request, with no CSRF token, no Origin/Referer validation, and no confirmation of user intent. An attacker can host a page that…
Gogs Admin User Edit CSRF to Git Hook RCE
Gogs' admin user-edit route (POST /admin/users/:userid) performs the state-changing grant of IsAdmin/AllowGitHook without a CSRF token, so an authenticated site administrator can be induced (e.g., via a cross-site form submission) to grant those rights to an…