CSRF
7 articles tagged CSRF, newest first.
Vik Booking 1.18.19 is its third security release in a week, with fixes for Vik Rent Car and Vik Rent Items
Vik Booking 1.18.19, Vik Rent Car 1.15.13 and Vik Rent Items 1.8.6 fix a CSRF gap and stored XSS. Three Vik Booking security releases in a week. What changed.
Phoca Download 6.1.6 adds the token check its file delete was missing
Phoca Download 6.1.6 fixes CVE-2026-102787, a CSRF flaw in front-end publish, unpublish and delete. Joomla 5 installs it by hand, Joomla 3 and 4 have no fix.
StageIt 5.8.0 and 6.4.0 fix CSRF on every action, and a settings file that could run PHP
StageIt 5.8.0 and 6.4.0 add CSRF protection to every staging action and stop an Options save writing PHP into params.php. Our reading, and what to do.
Gridbox 2.20.4.0 Fixes a Language Install CSRF and an Image Path Check
Gridbox 2.20.4.0 fixes a CSRF flaw in language installation and tightens image preview path checks. Every Joomla site on 2.20.3.1 or older should update.
EasyStore 3.0.1 Fixes Seven Security Flaws mySites.guru Found in 3.0.0 on Release Day
Before EasyStore 3.0.1, any visitor could pull a Joomla shop customer's home address and phone number from their email. mySites.guru found it and six more.
T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.
Helix Ultimate 2.2.7 Closes an Unauthenticated Menu Write
Helix Ultimate 2.2.7 fixes CSRF and permission gaps in com_ajax: an unauthenticated menu write leading to stored XSS, a file delete, and an open redirect.