CVE-2026-121451

The record

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.

Affected packages

Related vulnerabilities

• CVE-2026-110288 A cross-site request forgery vulnerability was identified in GitHub Enterprise Server… CWE-352
• CVE-2026-63433 MyTube is a self-hosted downloader and player for several video websites. CWE-352
• CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5… CWE-352
• CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request… CWE-352
• CVE-2026-120206 Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back… CWE-352
• CVE-2026-120207 Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that… CWE-352
• CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352
• CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows… CWE-352