What’s Vulnerable › Vulnerabilities

CVE-2021-47754: Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-352

Description

Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users into submitting the form.

Affected products

• Arunna: 1.0.0

References

• https://github.com/arunna/arunna
• https://web.archive.org/web/20211216074128/https://lyhinslab.org/index.php/2021/11/29/how-white-box-hacking-works-xss-csrf-in-arunna/
• https://www.exploit-db.com/exploits/50608
• https://web.archive.org/web/20211216074128/https://lyhinslab.org/index.php/2021/11/29/how-white-box-hacking-works-xss-csrf-in-arunna/
• https://www.exploit-db.com/exploits/50608

Get alerted when CVE-2021-47754 or the next vulnerability affects your stack