51044 matches found
GHSA-88XJ-97GF-7WPQ Moodle has a CSRF risk in user tours manager that allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
GHSA-9VC3-VM42-FJHM Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
Moodle has a CSRF risk in user tours manager that allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...
Cross-site Request Forgery (CSRF)
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF protection in the user tours manager. An attacker can duplicate existing tours without needing authentication by exploiting this vulnerabilit...
GHSA-M8QH-HX4C-H9HR Moodle has a CSRF risk in Brickfield tool's analysis request action
A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery CSRF risk...
UBUNTU-CVE-2025-3637
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
CVE-2025-3637
Moodle vulnerability CVE-2025-3637: CSRF protection data is exposed via the URL on mod_data edit and delete pages, allowing confidential information to be shared publicly. The issue is described as token exposure in GET parameters, specifically affecting Moodle’s mod_data edit/delete workflows. N...
CVE-2025-3637 Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
CVE-2025-3637 Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
CVE-2025-3637 Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery CSRF attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages...
CVE-2025-3635 Moodle: csrf risk in moodle user tours manager allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...
CVE-2025-3635 Moodle: csrf risk in moodle user tours manager allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...
WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by johska Patchstack Alliance in WordPress Plugin CheckBot versions = 1.05...
CVE-2025-46547
In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue...
CVE-2025-46547
In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue...
PT-2025-17869 · Unknown · Sherpa Orchestrator
Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The web application lacks protection against CSRF attacks, allowing an attacker to conduct XSS attacks, add a new user or role, or exploit a SQL injection issue. Recommendations: For Sherpa...
CVE-2025-46547
In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue...
CVE-2025-46547
CVE-2025-46547 : In Sherpa Orchestrator 141851, the web application lacks CSRF protection, enabling an attacker to perform actions such as XSS, adding a new user or role, or triggering SQL injection. The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVE list) with similar descrip...