Flash Games <= 2.2 - CSRF Bypass

The plugin does not properly check for CSRF in its cgwpsearchgame AJAX action, however we could not identify a risk associated with it...

Haxcan <= 1.0.0 - CSRF Bypass

The plugin does not properly check for CSRF in its getajaxresponse AJAX action, allowing attacker to make logged in admin call them it via CSRF attack and add arbitrary files in quarantine for example. Add an arbitrary file to quarantine...

Instantio < 1.2.6 - CSRF Bypass

The plugin did not properly check for CSRF in its wivariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

Express Shop < 4.0.3 - CSRF Bypass

The plugin did not properly check for CSRF in its qcldexpressvariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

Dictionary-Of-Pentesting

This repository is an offensive tool for Bug Bounty and penetration testing, specifically targeting WordPress and other web applications. It contains a collection of exploits and techniques for bypassing security measures, including account takeover, cross-site scripting XSS, denial of service Do...

CSRF Bypass in Multiple Plugins

Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions...

CVE-2021-29435

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

CVE-2021-29435

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

Post SMTP Mailer/Email Log < 2.0.21 - CSRF Nonce Bypass

A user could bypass the nonce check associated with Export mail to CSV handleCsvExport function PoC Submit a request w/o the post-smtp-log-nonce parameter...

CVE-2020-35239

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...

PT-2021-11738 · Cakephp · Cakephp

Name of the Vulnerable Software and Affected Versions: CakePHP versions 4.0.x through 4.1.3 Description: A vulnerability exists in the CsrfProtectionMiddleware component, allowing method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is n...

CVE-2020-8465

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass CVE-2020-8461 and authentication bypass CVE-2020-8464 to execute code as user root...

CVE-2020-8465

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass CVE-2020-8461 and authentication bypass CVE-2020-8464 to execute code as user root...

Design/Logic Flaw

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass CVE-2020-8461 and authentication bypass CVE-2020-8464 to execute code as user root...

CVE-2020-8465

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass CVE-2020-8461 and authentication bypass CVE-2020-8464 to execute code as user root...

CVE-2020-8465

CVE-2020-8465 affects Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2. Connected sources describe it as part of multiple vulnerabilities in IWSVA (with CVEs 2020-8461/8464) that enable authentication bypass and remote code execution, potentially allowing code execution as root via sy...

openSUSE Security Update : roundcubemail (openSUSE-2020-1516)

This update for roundcubemail fixes the following issues : roundcubemail was upgraded to 1.3.15 This is a security update to the LTS version 1.3. boo1175135 - Security: Fix cross-site scripting XSS via HTML messages with malicious svg content CVE-2020-16145 - Security: Fix cross-site scripting XS...

OPENSUSE-SU-2020:1516-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: roundcubemail was upgraded to 1.3.15 This is a security update to the LTS version 1.3. boo1175135 Security: Fix cross-site scripting XSS via HTML messages with malicious svg content CVE-2020-16145 Security: Fix cross-site scripting XSS via...

Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues

Throughout the plugin’s code, security nonces can be bypassed because they are only checked if they are set...

Brave Software: Cross-origin resource sharing misconfiguration (CORS)

Hi! In this report I want to describe High level bug which can seriously compromise a user account. If I am authorize on this site, I can steal user's sessions, some personal information or do some action. In my tests, I found the relevant vulnerability using different methods. I detected the COR...