CVE-2026-33920
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of t
CVSS
3.5
Low
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Sep 8, 2026 · Last modified: Oct 15, 2026 · CWE-352
0.1%EPSS · 30 days0.1%
2026-09-282026-10-26
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1168639.6 CRI—
———Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.2hCVE-2026-1175368.8 HIG—
——0REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.3hCVE-2026-1175345.4 MED—
——0REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.3hCVE-2026-1168955.4 MED—
——0REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.3hCVE-2026-1168807.1 HIG—
——0Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.3hCVE-2026-102787——
——0Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.53h