https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 06:58:04 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-90900 <p>Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&amp;task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) in ProductController, injecting HTMLHelper::_(&#39;form.token&#39;) into the review form template, and appending the session token to the submission payload in review-form.js.</p> <p>Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&amp;task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) in ProductController, injecting HTMLHelper::_(&#39;form.token&#39;) into the review form template, and appending the session token to the submission payload in review-form.js.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-90900 https://vulnerability.circl.lu/vuln/ghsa-rf4v-mqxp-593r <p>Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&amp;task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) in ProductController, injecting HTMLHelper::_(&#39;form.token&#39;) into the review form template, and appending the session token to the submission payload in review-form.js.</p> <p>Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&amp;task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken(&#39;request&#39;) / Session::checkToken(&#39;post&#39;) in ProductController, injecting HTMLHelper::_(&#39;form.token&#39;) into the review form template, and appending the session token to the submission payload in review-form.js.</p> https://vulnerability.circl.lu/vuln/ghsa-rf4v-mqxp-593r