Vulnerability · Published Feb 4, 2026 · Assigned by VulDB

CVE-2026-1835lcg0124 BootDo cross-site request forgery

Medium 4.3

In plain English

A medium-severity cross-site request forgery in BootDo from lcg0124. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown part. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified.

Affected products (as reported)

Vendor	Product	Versions
lcg0124	BootDo	e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb

Weakness: CWE-352, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-344028 | lcg0124 BootDo cross-site request forgery vdb-entry, technical-description
VDB-344028 | CTI Indicators (IOB, IOC) signature, permissions-required
Submit #742484 | BootDo Web V1.0 CSRF third-party-advisory
https://github.com/webzzaa/CVE-/issues/6 exploit, issue-tracking