CVE-2026-82764
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.15%
- CWE
- CWE-352
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Contec Co., Ltd. FXA5000
- Contec Co., Ltd. FXA5020
- Contec Co., Ltd. FXA5020-[][]
- Contec Co., Ltd. FXE5000
- Contec Co., Ltd. FXE5000-[][]
- Contec Co., Ltd. FXS5000-[][]
- Contec Co., Ltd. FXS5021
- Contec Co., Ltd. FXE4000
Weakness type
Related vulnerabilities
- CVE-2026-19650 — Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-46409 — OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
- CVE-2026-70376 — Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
- CVE-2026-65471 — WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57784 — WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-53649 — Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- CVE-2026-28164 — WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-52777 — YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize