50764 matches found
CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...
CVE-2025-55147
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote unauthenticated attacker to execute sensitive actions on behalf of...
PT-2025-36811
Name of the Vulnerable Software and Affected Versions: WooCommerce Booking Bundle Hours versions through 0.7.4 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Cristiano Zanca WooCommerce Booking Bundle Hours, which can lead to Stored Cross-Site Scripting XSS. Recommendation...
CVE-2025-7040
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...
CVE-2025-58809
Cross-Site Request Forgery CSRF vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Lead For Salesforce: from n/a through = 2.7.3.9...
CVE-2025-58861
Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calendar: from n/a through = 1.4.9...
CVE-2025-7040
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...
CVE-2025-7040
The Wordfence Vulnerability (CVE-2025-7040) affects the Cloud SAML SSO plugin for WordPress up to version 1.0.19. The issue is a missing capability check on the set_organization_settings action inside csso_handle_actions(), allowing unauthenticated attackers to submit POST data that is passed dir...
CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...
PT-2025-36356
Name of the Vulnerable Software and Affected Versions: Cloud SAML SSO plugin for WordPress versions up to and including 1.0.19 Description: The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set organization settings...
MAL-2025-44141 Malicious code in entanglement-csrf-wasat-avior (npm)
The package entanglement-csrf-wasat-avior was found to contain malicious code...
MAL-2025-46243 Malicious code in taurus-ganymede-csrf-relay (npm)
The package taurus-ganymede-csrf-relay was found to contain malicious code...
Malicious code in xanadu-csrf-module-npm (npm)
The package xanadu-csrf-module-npm was found to contain malicious code...
Malicious code in proxima-csrf-farout-despina (npm)
The package proxima-csrf-farout-despina was found to contain malicious code...
Malicious code in ultra-hapi-csrf-jabbah (npm)
The package ultra-hapi-csrf-jabbah was found to contain malicious code...
Malicious code in entanglement-csrf-wasat-avior (npm)
The package entanglement-csrf-wasat-avior was found to contain malicious code...
MAL-2025-46438 Malicious code in ultra-hapi-csrf-jabbah (npm)
The package ultra-hapi-csrf-jabbah was found to contain malicious code...
MAL-2025-43675 Malicious code in bulma-csrf-polaris-terser (npm)
The package bulma-csrf-polaris-terser was found to contain malicious code...