CVE-2025-58199
Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/
CVSS
4.3
Média
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 22 de set. de 2025 · Última mod.: 19 de out. de 2026 · CWE-352
0.1%EPSS · 30 dias0.1%
2026-10-132026-11-10
Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1253396.1 MÉD—
——0Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.6hCVE-2026-1181526.5 MÉD—
——0Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.6hCVE-2026-1094817.5 ALT—
——0Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.7hCVE-2026-1242518.8 ALT—
——0Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.9hCVE-2026-1121375.4 MÉD—
——0A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.14hCVE-2026-600418.1 ALT9.1%
——3An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.9h