PoC Archive PoC Archive

tag

Csrf

Sliver C2 MCP Server Unauthenticated CORS/Preflight Bypass (CVE-2026-34227)
CVE-2026-34227 (GHSA-6fpf-248c-m7wm) web Unverified
CVE-2026-34227webHIGHUnverified2026-07-05Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)
CVE-2026-34200 (GHSA-6c5x-3h35-vvw2) web Patched
CVE-2026-34200webCRITICAL 9.6Patched2026-07-05JupyterHub Cross-Origin Form POST XSRF Bypass (CVE-2026-40864)
CVE-2026-40864 (GHSA-m68r-v472-jgq9) web Patched
CVE-2026-40864webMEDIUMPatched2026-07-05Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290 KEV EPSS 30%
CVE-2026-56290 web Patched
CVE-2026-56290webCRITICAL 9.8Patched2026-07-05Friendly Functions for Welcart WordPress Plugin CSRF (CVE-2026-1208)
CVE-2026-1208 web Patched
CVE-2026-1208webMEDIUM 4.3Patched2026-07-05diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)
CVE-2026-38934 web Unverified
CVE-2026-38934webHIGH 8.8Unverified2026-07-05Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862
CVE-2026-30862 (GHSA-5hw4-whxv-6794) web Patched
CVE-2026-30862webCRITICAL 9.1Patched2026-07-05AdminPanel 4.0 CSRF File Deletion / Setup-Mode Reset — CVE-2026-30498
CVE-2026-30498 (reserved by MITRE) web Unverified
CVE-2026-30498webHIGHUnverified2026-07-05Gogs Admin User Edit CSRF to Git Hook RCE
None assigned as of 2026-07-03 web Unverified
None assigned as of 2026-07-03webCRITICALUnverified2026-07-03