CVE-2026-77391CWE-352CWE-862broken-access-controlcsrf

CVE-2026-77391

Medium · published August 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00230 · 13.0th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2026-08-21T06:16Z
References (7)
https://gist.github.com/rionyxraiza/428d4481fe471704829ca06de7be9d8c · [email protected]https://vuldb.com/cve/CVE-2026-77391 · [email protected]https://vuldb.com/submit/881030 · [email protected]https://vuldb.com/vuln/393853 · [email protected]https://vuldb.com/vuln/393853/cti · [email protected]https://www.sourcecodester.com/ · [email protected]https://vuldb.com/submit/881030 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 AUG 01:15Z
    SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
    cvelistv5