CVE-2024-42504

A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery CSRF in the login flow...

PT-2024-29994 · Hewlett Packard · Hpe Icewall Agent

Name of the Vulnerable Software and Affected Versions: HPE IceWall Agent products affected versions not specified Description: A security issue in HPE IceWall Agent products can be exploited remotely, leading to a Cross-Site Request Forgery CSRF in the login flow. This allows for unauthorized...

CVE-2024-45983

A Cross-Site Request Forgery CSRF vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially...

CVE-2024-45983

A Cross-Site Request Forgery CSRF vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially...

CVE-2024-47082 Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable ...

CVE-2024-47082 Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable ...

CVE-2024-46600

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/doAdminAction.php?act=delCate&id=31...

CVE-2024-8476

The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeeventpluginbuttons function. This makes it possible for unauthenticated attackers to delete arbitrary...

PT-2024-32068 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/admin/doAdminAction.php" API endpoint, specifically when the act parameter is set to delCate and the...

CVE-2024-46485

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=addCate...

CVE-2024-46600

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/doAdminAction.php?act=delCate&id=31...

CVE-2024-46485

Affected software: dingfanzu CMS 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered via the admin endpoint /admin/doAdminAction.php?act=addCate. Root cause: CSRF vulnerability in the action endpoint allowing unauthorized actions if a user is authenticated. Impact:...

CVE-2024-46600

CVE-2024-46600 affects dingfanzu CMS 1.0. A CSRF vulnerability exists in /admin/doAdminAction.php?act=delCate&id=31, enabling unauthorized actions on behalf of an authenticated user. The detail set notes the issue arises from the delCate action; no explicit patch version is provided. Remediation ...

Multiple vulnerabilities in PLANEX COMMUNICATIONS network devices

Overview Multiple network devices network cameras and a router provided by PLANEX COMMUNICATIONS INC. contain multiple vulnerabilities listed below. Cross-site request forgery CWE-352 - CVE-2024-45372 Cross-site scripting vulnerability in the web management page CWE-79 - CVE-2024-45836...

CVE-2024-8795

The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the myaccountupdate function. This makes it possible for unauthenticated attackers to update a user's accou...

Vaidya-Mitra 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Vaidya-Mitra v 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | |...

CVE-2024-46086

FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/plugin/filemanager/delete/123...

CVE-2024-46362

FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/plugin/filemanager/createdirectory...

CVE-2024-8092

The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8092

The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...