50764 matches found
Malicious code in yaml-avior-sync-csrf (npm)
The package yaml-avior-sync-csrf was found to contain malicious code...
Malicious code in csrf-ursa-rest-carpo (npm)
The package csrf-ursa-rest-carpo was found to contain malicious code...
MAL-2025-31403 Malicious code in quito-cryovolcano-relay-csrf (npm)
The package quito-cryovolcano-relay-csrf was found to contain malicious code...
MAL-2025-15085 Malicious code in auth-jwt-csrf-kinetic (npm)
The package auth-jwt-csrf-kinetic was found to contain malicious code...
MAL-2025-32035 Malicious code in rehype-redshift-aether-csrf (npm)
The package rehype-redshift-aether-csrf was found to contain malicious code...
WordPress Findgo Theme <= 1.3.57 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by 0xd4rk5id3 in WordPress Theme Findgo versions = 1.3.57...
PT-2025-33379 · Unknown · Apustheme Findgo
Name of the Vulnerable Software and Affected Versions: ApusTheme Findgo versions through 1.3.57 Description: A Cross-Site Request Forgery CSRF vulnerability exists in ApusTheme Findgo, allowing attackers to perform actions on behalf of an unsuspecting user. Recommendations: Update ApusTheme Findg...
CVE-2020-9322
Statamic Core prior to 2.11.8 exposes a cross-site scripting (XSS) vulnerability via the /users endpoint. This can be exploited through CSRF to create an administrator user. Stored XSS is possible when a JavaScript payload is placed in the username during account registration, and reflected XSS c...
CVE-2025-51541
A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The cdatabaseschema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious...
ROS-20250806-13
Golang programming language vulnerability is related to improper input validation. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code A vulnerability in the crypto-elliptic component of the Golang programming language is related to the...
CVE-2025-51541
A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The cdatabaseschema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious...
CVE-2025-51541
Shopware 6 stores user input in /recovery/install/database-configuration/ via the c_database_schema field without proper sanitization, enabling stored XSS. The issue can be triggered through a CSRF-enabled POST; lack of CSRF protections allows an unauthenticated attacker to craft a page that stor...
PT-2025-31974 · Shopware · Shopware 6
Name of the Vulnerable Software and Affected Versions: Shopware 6 affected versions not specified Description: A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface. The c database schema field does not properly sanitize user-supplied input before renderi...
CVE-2025-51541
A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The cdatabaseschema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious...
CVE-2025-5988
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda. Mitigation Use HTTPS on the platform ingress if possible. Since this is a problem in edge-terminated...
CVE-2025-5988
A CVE (CVE-2025-5988) affects Ansible Automation Platform’s aap-gateway, where CSRF origin checking is not performed on requests from the gateway to external components (controller, hub, eda). The issue is documented in Red Hat’s advisory RHSA-2025:12772 and Red Hat notes that automation-gateway ...
CVE-2025-5988 Aap-gateway: csrf origin checking is disabled
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda...
CVE-2025-5988 Aap-gateway: csrf origin checking is disabled
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda...
CVE-2025-54782 @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...