Common Weakness Enumeration
CWE-352
AllowedCross-Site Request Forgery (CSRF)
Abstraction: Compound · Status: Stable
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
14639 vulnerabilities reference this CWE, most recent first.
CVE-2026-94404 (GCVE-0-2026-94404)
Vulnerability from cvelistv5 – Published: 2026-09-21 13:50 – Updated: 2026-09-21 14:48
VLAI
EPSS
VEX
Title
MISP CSRF vulnerability allows unauthorized attribute modification
Summary
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:34 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/dfbae33f9 | patch |
GCVE extensions
AI-generated
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-21 13:38 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/dfbae33f9.patch
beb65b8daaa1… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
dfbae33f9a93
|
fix: [security] Keep the CSRF check on the inline attribute | beb65b8daaa1… |
Fix summary
The editField action is removed from the Security component's unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.
Patch summary
In app/Controller/AttributesController.php, the string 'editField' is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding 'editField' to $this->Security->unlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.
CVSS rationale
AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker's control. PR:N: The attacker needs no account on MISP; the victim's existing session is sufficient. UI:P: The victim must passively load the attacker's page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.
Weakness rationale
- CWE-352 The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim's session cookie, a textbook CSRF weakness.
Attack pattern rationale
- CAPEC-124 The patch description explicitly states that a cross-site form post carrying the victim's session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim's browser to send an authenticated request to a target application without the victim's knowledge or consent. CAPEC-124 is the most direct and specific match.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit 'affected' or 'fixed' version strings are provided in the metadata, so the exact version boundary is approximate.
- UI:P (Passive) is assumed because the commit message describes a 'cross-site form post' that auto-submits when the victim's browser loads the attacker's page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.
- PR:N is assumed because the attacker does not need their own MISP account; the victim's authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.
- The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.
- The Co-Authored-By AI tool is included as a 'tool' credit based on explicit commit metadata; it is not a human contributor.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | high | 5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:34:58.261364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:48:16.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"AttributesController"
],
"product": "MISP",
"programFiles": [
"app/Controller/AttributesController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
}
],
"value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-124",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-124 Cross-Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T13:50:46.410Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/dfbae33f9"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
}
],
"value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
}
],
"title": "MISP CSRF vulnerability allows unauthorized attribute modification",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
"UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
"PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
"The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
"The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
],
"capecRationale": [
{
"capecId": "CAPEC-124",
"rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
}
],
"commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
"fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
"generatedAt": "2026-09-21T13:38:54.473662Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
"patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
"patchTruncated": false,
"patches": [
{
"commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
"patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
"source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"subject": "fix: [security] Keep the CSRF check on the inline attribute"
}
],
"source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
"subject": "fix: [security] Keep the CSRF check on the inline attribute",
"tagVersionBoundary": {
"commits_after_fix": 7,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-94404",
"datePublished": "2026-09-21T13:50:46.410Z",
"dateReserved": "2026-09-21T13:50:44.676Z",
"dateUpdated": "2026-09-21T14:48:16.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93873 (GCVE-0-2026-93873)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 20:21
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:20 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1895 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1903 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93873",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:20:44.146800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:09.601Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/contact/contact.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:38.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1903"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/contact/contact.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-contact-plugin"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93873",
"datePublished": "2026-09-18T19:56:38.530Z",
"dateReserved": "2026-09-18T19:39:42.366Z",
"dateUpdated": "2026-09-18T20:21:09.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93870 (GCVE-0-2026-93870)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
Severity
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1892 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1900 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/ratings/ratings.ajax.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:36.178Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1892"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1900"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-ratings-plugin-ajax-handler"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93870",
"datePublished": "2026-09-18T19:56:36.178Z",
"dateReserved": "2026-09-18T19:39:36.923Z",
"dateUpdated": "2026-09-18T19:56:36.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93531 (GCVE-0-2026-93531)
Vulnerability from cvelistv5 – Published: 2026-09-18 15:15 – Updated: 2026-09-18 16:19
VLAI
EPSS
VEX
Title
gedelumbung HospitalManagement cross-site request forgery
Summary
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 16:19 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/407444 | vdb-entry |
| https://vuldb.com/vuln/407444/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93531 | third-party-advisory |
| https://vuldb.com/submit/943244 | third-party-advisory |
| https://github.com/gedelumbung/HospitalManagement… | exploitissue-tracking |
| https://github.com/gedelumbung/HospitalManagement/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gedelumbung | HospitalManagement |
Affected:
c2d45543789a3887067d3915f69d44cfc2cf76a8
cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93531",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T16:19:20.983950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:19:35.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"
],
"product": "HospitalManagement",
"vendor": "gedelumbung",
"versions": [
{
"status": "affected",
"version": "c2d45543789a3887067d3915f69d44cfc2cf76a8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "m1rr0r199411 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T15:15:13.564Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-407444 | gedelumbung HospitalManagement cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/407444"
},
{
"name": "VDB-407444 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/407444/cti"
},
{
"name": "CVE-2026-93531 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93531"
},
{
"name": "Submit #943244 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross-Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/943244"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/gedelumbung/HospitalManagement/issues/6"
},
{
"tags": [
"product"
],
"url": "https://github.com/gedelumbung/HospitalManagement/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-18T10:55:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "gedelumbung HospitalManagement cross-site request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93531",
"datePublished": "2026-09-18T15:15:13.564Z",
"dateReserved": "2026-09-18T08:50:43.661Z",
"dateUpdated": "2026-09-18T16:19:35.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93456 (GCVE-0-2026-93456)
Vulnerability from cvelistv5 – Published: 2026-09-18 01:24 – Updated: 2026-09-21 20:52
VLAI
EPSS
VEX
Title
django-page-cms through 2.0.13 CSRF via admin mutation views
Summary
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:28 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/batiste/django-page-cms/issues/244 | issue-tracking |
| https://github.com/batiste/django-page-cms | product |
| https://github.com/batiste/django-page-cms/blob/b… | technical-description |
| https://github.com/batiste/django-page-cms/blob/b… | technical-description |
| https://www.vulncheck.com/advisories/django-page-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| batiste | django-page-cms |
Affected:
0 , ≤ 2.0.13
(semver)
|
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:28:46.685546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:52:22.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/django-page-cms",
"product": "django-page-cms",
"vendor": "batiste",
"versions": [
{
"lessThanOrEqual": "2.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T01:24:04.861Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #244",
"tags": [
"issue-tracking"
],
"url": "https://github.com/batiste/django-page-cms/issues/244"
},
{
"tags": [
"product"
],
"url": "https://github.com/batiste/django-page-cms"
},
{
"name": "modify_content() is decorated @csrf_exempt, one of five admin mutation views at lines 20, 52, 79, 142 and 182",
"tags": [
"technical-description"
],
"url": "https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L51-L53"
},
{
"name": "PlaceholderNode.get_render_content() wraps stored content in mark_safe() before rendering",
"tags": [
"technical-description"
],
"url": "https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/placeholders.py#L238-L241"
},
{
"name": "VulnCheck Advisory: django-page-cms through 2.0.13 CSRF via admin mutation views",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/django-page-cms-through-2.0.13-csrf-via-admin-mutation-views"
}
],
"title": "django-page-cms through 2.0.13 CSRF via admin mutation views",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93456",
"datePublished": "2026-09-18T01:24:04.861Z",
"dateReserved": "2026-09-17T23:37:43.589Z",
"dateUpdated": "2026-09-21T20:52:22.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92806 (GCVE-0-2026-92806)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 13:43
VLAI
EPSS
VEX
Title
phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
Summary
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:43 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/phplist3.md | technical-descriptionexploit |
| https://github.com/phpList/phplist3/blob/v3.6.16/… | technical-description |
| https://github.com/phpList/phplist3/blob/v3.6.17/… | patch |
| https://github.com/phpList/phplist3 | product |
| https://www.vulncheck.com/advisories/phplist-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92806",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:43:12.243217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:43:54.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "phpList",
"vendor": "phpList",
"versions": [
{
"lessThan": "3.6.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phplist:phplist:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:55.350Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/phplist3.md"
},
{
"name": "the handler acts on POST data with no token check",
"tags": [
"technical-description"
],
"url": "https://github.com/phpList/phplist3/blob/v3.6.16/public_html/lists/admin/massremove.php#L13-L24"
},
{
"name": "3.6.17 requires verifyCsrfGetToken",
"tags": [
"patch"
],
"url": "https://github.com/phpList/phplist3/blob/v3.6.17/public_html/lists/admin/massremove.php#L10"
},
{
"tags": [
"product"
],
"url": "https://github.com/phpList/phplist3"
},
{
"name": "VulnCheck Advisory: phpList before 3.6.17 Cross-Site Request Forgery via massremove.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phplist-before-3.6.17-cross-site-request-forgery-via-massremove-php"
}
],
"title": "phpList before 3.6.17 Cross-Site Request Forgery via massremove.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92806",
"datePublished": "2026-09-16T20:32:55.350Z",
"dateReserved": "2026-09-16T19:47:15.211Z",
"dateUpdated": "2026-09-17T13:43:54.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92751 (GCVE-0-2026-92751)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 15:00
VLAI
EPSS
VEX
Title
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
Summary
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:59 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/yahoo/CMAK/issues/935 | issue-tracking |
| https://github.com/yahoo/CMAK | product |
| https://github.com/yahoo/CMAK/blob/3.0.0.6/app/lo… | technical-description |
| https://www.vulncheck.com/advisories/cmak-through… | third-party-advisory |
Date Public
2026-06-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92751",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:59:53.010945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:00:14.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yahoo/CMAK/issues/935"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CMAK",
"vendor": "yahoo",
"versions": [
{
"lessThanOrEqual": "3.0.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator\u0027s HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:24.178Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #935",
"tags": [
"issue-tracking"
],
"url": "https://github.com/yahoo/CMAK/issues/935"
},
{
"tags": [
"product"
],
"url": "https://github.com/yahoo/CMAK"
},
{
"name": "httpFilters installs only BasicAuthenticationFilter, no CSRFFilter",
"tags": [
"technical-description"
],
"url": "https://github.com/yahoo/CMAK/blob/3.0.0.6/app/loader/KafkaManagerLoader.scala#L48"
},
{
"name": "VulnCheck Advisory: CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-cross-site-request-forgery-via-missing-csrf-filter"
}
],
"title": "CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92751",
"datePublished": "2026-09-16T20:32:24.178Z",
"dateReserved": "2026-09-16T18:57:08.142Z",
"dateUpdated": "2026-09-17T15:00:14.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92582 (GCVE-0-2026-92582)
Vulnerability from cvelistv5 – Published: 2026-09-16 21:46 – Updated: 2026-09-17 19:23
VLAI
EPSS
VEX
Title
AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
Summary
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:15 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/avideo-throu… | third-party-advisory |
Impacted products
Date Public
2026-09-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:15:47.042415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:23:41.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "29.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rajivraj"
}
],
"datePublic": "2026-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo\u0027s automatic CSRF guard ($global[\u0027skipAutoCSRFCheck\u0027]) and the untrusted-request check ($global[\u0027bypassSameDomainCheck\u0027]) merely because \u0027user\u0027 and \u0027pass\u0027 parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records \u2014 including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T21:46:50.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qf9p-jhx7-rhmf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qf9p-jhx7-rhmf"
},
{
"name": "VulnCheck Advisory: AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-videoaddnew-json-php-csrf-bypass"
}
],
"title": "AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92582",
"datePublished": "2026-09-16T21:46:50.142Z",
"dateReserved": "2026-09-16T13:47:20.117Z",
"dateUpdated": "2026-09-17T19:23:41.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92383 (GCVE-0-2026-92383)
Vulnerability from cvelistv5 – Published: 2026-09-16 15:00 – Updated: 2026-09-16 15:05
VLAI
EPSS
VEX
Title
PbootCMS User Management UserController.php mod cross-site request forgery
Summary
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:04 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/405519 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/405519/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-92383 | third-party-advisory |
| https://vuldb.com/submit/938602 | third-party-advisory |
| https://github.com/pbootcmspro/PbootCMS/issues/70 | exploitissue-tracking |
| https://github.com/pbootcmspro/PbootCMS/commit/c2… | patch |
| https://github.com/pbootcmspro/PbootCMS/releases/… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PbootCMS |
Affected:
3.2.0
Affected: 3.2.1 Affected: 3.2.2 Affected: 3.2.3 Affected: 3.2.4 Affected: 3.2.5 Affected: 3.2.6 Affected: 3.2.7 Affected: 3.2.8 Affected: 3.2.9 Affected: 3.2.10 Affected: 3.2.11 Affected: 3.2.12 Affected: 3.2.13 Affected: 3.2.14 Affected: 3.2.15 Affected: 3.2.16 Affected: 3.2.17 Affected: 3.2.18 Affected: 3.2.19 Affected: 3.2.20 Affected: 3.2.21 Affected: 3.2.22 Affected: 3.2.23 Affected: 3.2.24 Unaffected: 3.2.25 cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92383",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:04:54.787250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:05:02.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"
],
"modules": [
"User Management"
],
"product": "PbootCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
},
{
"status": "affected",
"version": "3.2.2"
},
{
"status": "affected",
"version": "3.2.3"
},
{
"status": "affected",
"version": "3.2.4"
},
{
"status": "affected",
"version": "3.2.5"
},
{
"status": "affected",
"version": "3.2.6"
},
{
"status": "affected",
"version": "3.2.7"
},
{
"status": "affected",
"version": "3.2.8"
},
{
"status": "affected",
"version": "3.2.9"
},
{
"status": "affected",
"version": "3.2.10"
},
{
"status": "affected",
"version": "3.2.11"
},
{
"status": "affected",
"version": "3.2.12"
},
{
"status": "affected",
"version": "3.2.13"
},
{
"status": "affected",
"version": "3.2.14"
},
{
"status": "affected",
"version": "3.2.15"
},
{
"status": "affected",
"version": "3.2.16"
},
{
"status": "affected",
"version": "3.2.17"
},
{
"status": "affected",
"version": "3.2.18"
},
{
"status": "affected",
"version": "3.2.19"
},
{
"status": "affected",
"version": "3.2.20"
},
{
"status": "affected",
"version": "3.2.21"
},
{
"status": "affected",
"version": "3.2.22"
},
{
"status": "affected",
"version": "3.2.23"
},
{
"status": "affected",
"version": "3.2.24"
},
{
"status": "unaffected",
"version": "3.2.25"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rockmelodeis (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:00:11.259Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-405519 | PbootCMS User Management UserController.php mod cross-site request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/405519"
},
{
"name": "VDB-405519 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/405519/cti"
},
{
"name": "CVE-2026-92383 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-92383"
},
{
"name": "Submit #938602 | pbootcmspro PbootCMS \u003c=V3.2.21 Deletion of Data Structure Sentinel",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/938602"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/pbootcmspro/PbootCMS/issues/70"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pbootcmspro/PbootCMS/commit/c25241a0964742cefb7f698efbb6c38b868d6ff7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pbootcmspro/PbootCMS/releases/tag/V3.2.25"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-16T10:06:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "PbootCMS User Management UserController.php mod cross-site request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-92383",
"datePublished": "2026-09-16T15:00:11.259Z",
"dateReserved": "2026-09-16T08:01:43.835Z",
"dateUpdated": "2026-09-16T15:05:02.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91857 (GCVE-0-2026-91857)
Vulnerability from cvelistv5 – Published: 2026-09-15 09:14 – Updated: 2026-09-15 13:19
VLAI
EPSS
VEX
Title
MISP: State-changing actions accessible via GET request enabling CSRF
Summary
Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsController::purgeUnusedPictures()
- NoticelistsController::enableNoticelist()
- ServersController::removeOrphanedCorrelations()
- WorkflowsController::rebuildRedis()
The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests.
For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.
Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session.
Version affected: ≤2.5.45
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:10 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/b4a5486b5 | patch |
GCVE extensions
AI-generated
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-15 09:10 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/b4a5486b5.patch
adc31514b96a… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
b4a5486b5ddd
|
fix: [security] Require POST for four remaining | adc31514b96a… |
Fix summary
The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page's CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.
Patch summary
Adds $this->request->allowMethod(['post']) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly(['purgeUnusedPictures']) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type 'post' and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.
CVSS rationale
AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.
Weakness rationale
- CWE-352 The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework's CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF.
Assumptions to verify
- The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.
- MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP's standard authentication model.
- The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch's own comments.
- The vulnerability was found during internal review and was not externally reported, per the commit message.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 9 | high | 4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:10:25.729586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:19:25.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"EventReportsController",
"NoticelistsController",
"ServersController",
"WorkflowsController"
],
"product": "MISP",
"programFiles": [
"app/Controller/EventReportsController.php",
"app/Controller/NoticelistsController.php",
"app/Controller/ServersController.php",
"app/Controller/WorkflowsController.php",
"app/View/EventReports/managed_imported_pictures.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP expose several state-changing controller actions without restricting them to POST.\u003c/p\u003e\n\u003cp\u003eThe affected actions are:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003ccode\u003e\u2003-\u0026nbsp;EventReportsController::purgeUnusedPictures()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;NoticelistsController::enableNoticelist()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;ServersController::removeOrphanedCorrelations()\u003c/code\u003e\n\u003cbr\u003e\u003cdiv\u003e\u003ccode\u003e\u2003- WorkflowsController::rebuildRedis()\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eThe patch adds \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e to each action, preventing them from being triggered through ordinary GET requests.\u003c/p\u003e\n\u003cp\u003eFor \u003ccode\u003epurgeUnusedPictures()\u003c/code\u003e, the corresponding UI previously used \u003ccode\u003e$.get()\u003c/code\u003e. The fix converts that request to POST and supplies \u003ccode\u003eX-CSRF-Token\u003c/code\u003e, while the controller enables header-only CSRF validation for that AJAX action.\u003c/p\u003e\n\u003cp\u003eBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n\u2003-\u00a0EventReportsController::purgeUnusedPictures()\n\n\u2003-\u00a0NoticelistsController::enableNoticelist()\n\n\u2003-\u00a0ServersController::removeOrphanedCorrelations()\n\n\u2003- WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod([\u0027post\u0027]) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T09:14:43.722Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/b4a5486b5"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form."
}
],
"title": "MISP: State-changing actions accessible via GET request enabling CSRF",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.",
"MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP\u0027s standard authentication model.",
"The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch\u0027s own comments.",
"The vulnerability was found during internal review and was not externally reported, per the commit message."
],
"commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.",
"draft": false,
"fixSummary": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.",
"generatedAt": "2026-09-15T09:10:36.581856Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
"patchSummary": "Adds $this-\u003erequest-\u003eallowMethod([\u0027post\u0027]) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly([\u0027purgeUnusedPictures\u0027]) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type \u0027post\u0027 and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.",
"patchTruncated": false,
"patches": [
{
"commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
"patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
"source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"subject": "fix: [security] Require POST for four remaining"
}
],
"source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
"subject": "fix: [security] Require POST for four remaining",
"tagVersionBoundary": {
"commits_after_fix": 196,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-352",
"rationale": "The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework\u0027s CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20242"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-91857",
"datePublished": "2026-09-15T09:14:43.722Z",
"dateReserved": "2026-09-15T09:14:39.778Z",
"dateUpdated": "2026-09-15T13:19:25.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
- Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Mitigation
Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Mitigation
Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Mitigation
Architecture and Design
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Mitigation
Architecture and Design
- Use the "double-submitted cookie" method as described by Felten and Zeller:
- When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
- Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
- This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Mitigation
Architecture and Design
Do not use the GET method for any request that triggers a state change.
Mitigation
Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-467: Cross Site Identification
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.