CVE-2025-36576

CVE-2025-36576 affects Dell Wyse Management Suite (WMS) prior to 5.2. A CSRF weakness could allow a high-privileged attacker with remote access to trigger server-side request forgery. Some sources (e.g., PT-2025-24898, Red Hat/CVE entries) corroborate the issue as a pre-5.2 vulnerability. Remedia...

CVE-2025-49510

CVE-2025-49510 is a CSRF vulnerability in the WordPress plugin Min Max Step Quantity Limits Manager for WooCommerce. Affected versions are up to and including 5.1.0. Remediation is available in version 5.1.0 (patched). No exploitation details are provided in the connected documents.

CVE-2025-49510 WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through 5.1.0...

CVE-2025-49511

CVE-2025-49511 : CSRF in Civi Framework (WordPress plugin) affects Civi Framework up to 2.1.6.x (CNVD lists 2.1.6.3). Root cause: insufficient verification of request origin leading to unauthorized actions. Exploitation details not provided in the documents. According to connected CNVD entry, pat...

PT-2025-24657 · WordPress · Wpfactory Min Max Step Quantity Limits Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Min Max Step Quantity Limits Manager for WooCommerce versions 5.1.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows unauthorized actions to be performed on behalf of a user. This...

WordPress plugin Bunnys Print CSS 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Bunnys Print CSS plugin that stems from missing or incorrect nonce validation of the pcssoptionssubpanel...

PT-2025-24898 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to 5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2025-45055

Silverpeas 6.4.2 is affected in the Event Management module by a stored XSS flaw: an authenticated user can upload a malicious SVG as an event attachment, and when an administrator views it, embedded JavaScript can run in the admin session. This stems from insufficient sanitization of SVG files a...

CVE-2025-30986

Cross-Site Request Forgery CSRF vulnerability in CreativeMedia Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through = 10.0.5...

CVE-2025-30632

Cross-Site Request Forgery CSRF vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Translator: from n/a through = 2.0.2...

CVE-2025-29005

Cross-Site Request Forgery CSRF vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through = 3.6...

CVE-2025-49285

Cross-Site Request Forgery CSRF vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through = 3.8.0...

CVE-2025-49291

Cross-Site Request Forgery CSRF vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through = 5.3.58...

CVE-2025-27360

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

CVE-2025-30995

Cross-Site Request Forgery CSRF vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through = 3.0...

CVE-2025-49425

Cross-Site Request Forgery CSRF vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: from n/a through = v0.4...

CVE-2025-49453

Cross-Site Request Forgery CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through = 1.1...

CVE-2025-46341

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed functionality an...