CVE-2021-41764

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.

• CWE-352

• https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3fExploit, Third Party Advisory
• https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93Third Party Advisory
• https://github.com/streamaserver/streamaProduct, Third Party Advisory
• https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3fExploit, Third Party Advisory
• https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93Third Party Advisory
• https://github.com/streamaserver/streamaProduct, Third Party Advisory

Published

Sep 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41752Stack overflow vulnerability in Jerryscript before commit e1…9.8
• CVE-2021-41753A denial-of-service attack in WPA2, and WPA3-SAE authenticat…7.5
• CVE-2021-41754dynamicMarkt <= 3.10 is affected by SQL injection in the par…9.8
• CVE-2021-41755dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-41756dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-4176livehelperchat is vulnerable to Improper Neutralization of I…6.1
• CVE-2021-41765A SQL injection issue in pages/edit_fields/9_ajax/add_keywor…9.8
• CVE-2021-41766Apache Karaf allows monitoring of applications and the Java …8.1
• CVE-2021-41767Apache Guacamole 1.3.0 and older may incorrectly include a p…6.5
• CVE-2021-41769A vulnerability has been identified in SIPROTEC 5 6MD85 devi…7.5
• CVE-2021-4177livehelperchat is vulnerable to Generation of Error Message …5.3
• CVE-2021-41770Ping Identity PingFederate before 10.3.1 mishandles pre-pars…7.5