CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

CVE-2025-25927: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

CVE-2025-25928

OpenMRS version 2.4.3 Build 0ff0ed is vulnerable to a Cross-Site Request Forgery (CSRF) in the /admin/users/user.form component. This flaw allows an attacker to execute arbitrary operations via a crafted GET request, specifically enabling the elevation of a low-privileged account to an administra...

PT-2025-10900

Name of the Vulnerable Software and Affected Versions: Openmrs version 2.4.3 Build 0ff0ed Description: A Cross-Site Request Forgery CSRF issue allows attackers to execute arbitrary operations via a crafted GET request. Recommendations: For Openmrs version 2.4.3 Build 0ff0ed, consider implementing...

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

PT-2025-10901

Name of the Vulnerable Software and Affected Versions: Openmrs version 2.4.3 Build 0ff0ed Description: A Cross-Site Request Forgery CSRF issue in the /admin/users/user.form component allows attackers to execute arbitrary operations via a crafted GET request. Recommendations: For Openmrs version...

CVE-2025-27910

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-27910

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-27910

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

PT-2025-10639

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows attackers to execute arbitrary operations via a crafted GET or POST request to the /user/ajax/save API endpoint. This is due to a Cross-Site Request Forgery CSRF vulnerability. Recommendations Fo...

PT-2025-10641

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description A Cross-Site Request Forgery CSRF issue was discovered in the /user/ajax/upd/status component, allowing attackers to execute arbitrary operations via a crafted GET or POST request. Recommendations For version 2.3...

CVE-2025-27910

The tianti JAVA lightweight CMS solution (version 2.3 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the /user/ajax/upd/status component. This vulnerability allows an attacker to perform arbitrary operations by sending a specially crafted GET or POST request. To mitigate risk, it ...