CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once...

CVE-2025-22343 WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through = 1.2.0...

CVE-2024-37238 WordPress WPAdverts – Classifieds plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Greg Winiarski WPAdverts – Classifieds Plugin allows Cross Site Request Forgery.This issue affects WPAdverts – Classifieds Plugin: from n/a through 2.1.2...

CVE-2024-28143

The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e....

PT-2024-33374 · WordPress · Ahmeti Wp Timeline

Name of the Vulnerable Software and Affected Versions: Ahmeti Wp Timeline versions prior to 5.1 Description: A Cross-Site Request Forgery CSRF issue exists in Ahmet Imamoglu Ahmeti Wp Timeline, allowing Stored XSS. Recommendations: For versions prior to 5.1, update to a version that includes a fi...

PT-2024-30058 · Pligg Cms · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 2.0.2 Description: A Cross-Site Request Forgery CSRF issue was found in Pligg CMS. The issue is related to the "/admin/admin log.php?clear=1" endpoint. Recommendations: For Pligg CMS version 2.0.2, update to a version that...

PT-2024-24007 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.8 Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to perform unintended actions on a user's account. Recommendations: For versions...

PT-2024-20504 · Unknown · W3Speedster

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER versions prior to 7.20 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 7.20, update to version 7....

CVE-2022-0402 Superforms < 6.0.4 - Reflected Cross-Site Scripting

The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bobczypanstwasprawazostalarozwiazana parameter before outputting it back in an attribute via the superlanguageswitcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking...

PT-2023-32237 · WordPress · Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: WP Hotel Booking WordPress plugin versions prior to 2.0.8 Description: The issue concerns a lack of authorization and CSRF checks in the WP Hotel Booking WordPress plugin, which also fails to verify that the item to be deleted is indeed a...

PT-2023-21271 · Unknown · Shingo Intrepidity Plugin

Name of the Vulnerable Software and Affected Versions: Shingo Intrepidity plugin versions = 1.5.1 Description: The issue allows for Cross-Site Request Forgery CSRF which enables arbitrary file upload. Recommendations: For versions = 1.5.1, update to a version greater than 1.5.1 to resolve the iss...

Fedora 38 : wordpress (2023-e18d3d4004)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e18d3d4004 advisory. WordPress 6.2.2 Security Release Security updates included in this release: Block themes parsing shortcodes in user-generated data; thanks to Liam Gladdy of ...

PT-2023-20816 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A cross-site request forgery CSRF issue allows attackers to set a person to a user and then set that user to be an Administrator. Recommendations: For ChurchCRM version 4.5.3, at the moment, there is no...

apollo-portal has potential CSRF issue

Impact A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Patches Cookie SameSite strategy was set to Lax in 4664 and was...

PT-2023-14916 · Rumpus · Rumpus

Name of the Vulnerable Software and Affected Versions: Rumpus affected versions not specified Description: The issue is related to a Cross-site request forgery CSRF and privilege escalation vulnerability that may allow privilege escalation. Recommendations: At the moment, there is no information...

CVE-2022-3946 Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods...

OPENSUSE-SU-2022:10065-1 Security update for phpPgAdmin

This update for phpPgAdmin fixes the following issues: - CVE-2019-10784: Fixed improper source validation that could lead to CSRF boo1162794...

CVE-2022-27226

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSS

The plugin does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue which will be triggered in the admin dashboard due to the lack of escaping. v10.9.1 added a CSRF check, however...

PT-2021-7217 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.4 Description: The issue is related to the reuse of CSRF tokens by a malicious user, as no cleanup is done on these tokens on Windows servers. This can allow a remote attacker to perform a CSRF attack...