https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:15:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349612 EUVD-2026-349612 https://cve.radiocsirt.org/vuln/euvd-2026-349612 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70376 <p>Pluck CMS&#39;s admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.</p> <p>Pluck CMS&#39;s admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70376 https://cve.radiocsirt.org/vuln/ghsa-qg2j-83g4-98r4 <p>Pluck CMS&#39;s admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function&#39;s elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via &lt;meta name=referrer content=no-referrer&gt;), it can force an authenticated administrator&#39;s browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).</p> <p>Pluck CMS&#39;s admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function&#39;s elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via &lt;meta name=referrer content=no-referrer&gt;), it can force an authenticated administrator&#39;s browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).</p> https://cve.radiocsirt.org/vuln/ghsa-qg2j-83g4-98r4