CSRF | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Basic HTTP Authentication Risk: Uncovering pyspider Vulnerabilities	Reflected XSS CSRF Security Code Review	Pyspider	Yaniv Nizry (@YNizry)
CSRF Bypass Using Domain Confusion Leads To ATO	CSRF Account Takeover	Undisclosed	Osama Aly
Vulnerabilities in Homepage Dashboard	RCE SSRF CSRF Information Disclosure Jellyfin	Homepage	Daniel Kachakil
AI Under Siege: Discovering and Exploiting Vulnerabilities	AI Prompt Injection CSRF Markdown Injection OAuth	Undisclosed	Mosaad Sallam (@H0tak88r) Mohamed Walid (@L0daW)
How Almost Sacrificing a University Group Project led to a Microsoft Bug Bounty	XSS CSRF	Microsoft (GroupMe)	Alex Bryant Aditya Dindi Eric Esquivel
SSD Advisory – XenForo RCE Via CSRF	RCE CSRF Security Code Review	XenForo	Egidio Romano / EgiX
Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF	Client-Side Path Traversal CSRF	Undisclosed	Maxence Schmitt (@Maxenceschmitt)
CVE-2024-2448: Authenticated Command Injection In Progress Kemp LoadMaster	OS Command Injection CSRF Security Code Review	Progress (Kemp LoadMaster)	David Yesland (@Daveysec)
LedgerSMB – CVE-2024-23831: Privilege escalation through CSRF attack on “setup.pl”	CSRF	LedgerSMB	George Roumeliotis
The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”	Client-Side Path Traversal CSRF Self-XSS XSS	Undisclosed	Alvaro Balada
Multiple Vulnerabilities In Extreme Networks ExtremeXOS	Arbitrary File Read Arbitrary File Write SSRF RCE Privilege Escalation Local Privilege Escalation CSRF Security Code Review	Extreme Networks	David Yesland (@Daveysec)
Securing our home labs: Home Assistant code review	Insecure Deserialization CSRF RCE Code Injection Android IOS Security Code Review	Home Assistant	Alvaro Muñoz (@Pwntester)
A web cache deception chained to a CSRF, the recipe	Web Cache Deception CSRF	Undisclosed	Rachid.A (@Zhero___)
Technical Advisory: Vulnerabilities Identified within ListServ	CSRF Samesite Cookie Bypass Reflected XSS Stored XSS Unrestricted File Upload DLL Hijacking Local Privilege Escalation Buffer Overflow Memory Corruption	ListServ	Adam Crosser
Blog: OmniSpace, from automated 0day XSS to RCE	RCE XSS Account Takeover CSRF Insecure File Upload LFI Security Code Review	Agora-Project (OmniSpace)	Florent (@Pepito_oh)
Bypassing Samesite Cookie Restrictions with Method Override	Samesite Cookie Bypass CSRF	Undisclosed	Hazana (@HazanaSec)
HTML Over the Wire	CSRF Token Leak	Hotwire Turbo Htmx	Ryan (@Healthyoutlet)
CSRFing VS Code's Debug Adapter Protocol	CSRF RCE	Microsoft (VS Code)	Dan McNulty (@_Z7mcnulty)
Multiple vulnerabilities on Chamilo 1.11.18	OS Command Injection RCE SSRF IDOR XSS CSRF Security Code Review	Chamilo	Aituglo (@Aituglo)
Multiple Vulnerabilities In Cockpit CMS <= V2.5.2	CSRF Unrestricted File Upload RCE XSS IDOR Security Code Review	Cockpit CMS	GhostCcamm (@GhostCcamm)
My first two valid and rewarded Web Cache Deceptions, earning $2250	Web Cache Deception CSRF	Undisclosed	Benja (Bronxi) (@Hbenja_m)
A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, DOM-based XSS, CORS, CSRF…	PostMessage JSONP DOM XSS CORS Misconfiguration CSRF WAF Bypass	Undisclosed	Julien Cretel (@Jub0bs)
Simple Bugs 0x01: Password Changing to Account Takeover!	Account Takeover CSRF	Undisclosed	Vitor Falcao (@Egl_falcao)
Unveiling the Secrets: My Journey of Hacking Google’s OSS	CSRF Self-XSS	Google	7𝖍3𝖍4𝖈kv157 (@7h3h4ckv157)
Bypassing SameSite=lax cookie restrictions to preform CSRF resulting to a horizontal privilege escalation via poor email verification mechanism	CSRF	Undisclosed	Imad Husanovic (@Deadoverflow_)

Page 1 of 10