CVE-2026-31954
Emlog asynchronous media file deletion missing CSRF protection
Résumé
Emlog asynchronous media file deletion missing CSRF protection
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov