https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:06:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380356 EUVD-2026-380356 https://cve.radiocsirt.org/vuln/euvd-2026-380356 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58143 <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58143 https://cve.radiocsirt.org/vuln/ghsa-v64j-9r6x-4fv6 <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> https://cve.radiocsirt.org/vuln/ghsa-v64j-9r6x-4fv6