CVE-2026-4971

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-49722.4A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /sCVE-2026-49733.5A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of tCVE-2026-497382.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepaCVE-2026-49748.8A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of tCVE-2026-497406.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation oCVE-2026-497418.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition recordCVE-2026-497427.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via tCVE-2026-497437.8Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objCVE-2026-497447.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-497457.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-497467.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certCVE-2026-49758.8A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component P
CVE-2026-4971: Medium severity, CVSS 4.3 | Vulnix