CVE-2026-93870
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf o
CVSS
4.3
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 18 sept 2026 · Última mod.: 18 sept 2026 · CWE-352
Sin historial EPSS suficiente todavía.
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
- github.comhttps://github.com/Cotonti/Cotonti
- github.comhttps://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php
- github.comhttps://github.com/Cotonti/Cotonti/issues/1892
- github.comhttps://github.com/Cotonti/Cotonti/pull/1900
- www.vulncheck.comhttps://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-ratings-plugin-ajax-handler
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-938734.3 MED—
———Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.8hCVE-2026-840848.8 ALT—
———IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability.8hCVE-2026-840778.1 ALT—
———IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.8hCVE-2026-935314.3 MED—
———A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.10hCVE-2026-775684.2 MED—
———Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.11hCVE-2025-1539910.0 CRÍ—
———IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.11h