CVE-2016-10529
No CSRF Validation in droppy
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
- Record
CVE-2016-10529- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
- Record
CVE-2016-10529- Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2019-0339 No score
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
- Record
EUVD-2019-0339- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhvc-x32h-5526 No score
No CSRF Validation in droppy
Affected versions of droppy are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.
Recommendation
Update to version 3.5.0 or later.
- Record
GHSA-rhvc-x32h-5526- Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
- Record
CVE-2016-10529- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rhvc-x32h-5526 No score
No CSRF Validation in droppy
Affected versions of droppy are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.
Recommendation
Update to version 3.5.0 or later.
- Record
GHSA-rhvc-x32h-5526- Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
droppynpm |
before 3.5.0 | 3.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10529 is a high vulnerability (CVSS 8.8) in Droppy Project Droppy, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in droppy 3.5.0.