51093 matches found
CVE-2024-9847
CVE-2024-9847 affects FlatPress CMS (FlatPress) where authenticated users can be targeted by a Cross-Site Request Forgery (CSRF) flaw to enable or disable plugins on behalf of a victim user. The vulnerability arises from attackers using crafted requests that are processed as if initiated by the l...
CVE-2024-7760 CSRF in aimhubio/aim
aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery CSRF vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can b...
CVE-2024-7760
CVE-2024-7760 affects aimhubio/aim (v3.22.0) where the tracking server is vulnerable to Cross‑Site Request Forgery (CSRF) due to overly permissive CORS settings that allow cross-origin requests from all origins. This vulnerability enables CSRF on all endpoints of the tracking server and can be ch...
CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as...
CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as...
CVE-2024-10481
CVE-2024-10481 is a CSRF vulnerability in comfyanonymous/comfyui
PT-2025-12186
Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The software contains a Cross-Site Request Forgery CSRF vulnerability in the tracking server. This is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables...
PT-2025-12066 · Unknown · Binary-Husky/Gpt Academic
Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A Cross-Site Request Forgery CSRF issue allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads an...
PT-2025-12042 · Comfyanonymous · Comfyui
Name of the Vulnerable Software and Affected Versions: comfyanonymous/comfyui versions up to v0.2.2 Description: A CSRF issue exists, allowing attackers to host malicious websites that can perform arbitrary API requests on behalf of authenticated users when visited. This can be exploited to uploa...
Exploit for CVE-2024-52402
🚀 Exploit for CVE-2024-52402: WordPress Exclusive Content Pass...
CVE-2025-26899 WordPress Recapture for WooCommerce Plugin <= 1.0.43 - CSRF to Settings Change vulnerability
Cross-Site Request Forgery CSRF vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross Site Request Forgery.This issue affects Recapture for WooCommerce: from n/a through = 1.0.43...
CVE-2025-26899
The CVE-2025-26899 entry documents a Cross-Site Request Forgery (CSRF) to Settings Change vulnerability in the WordPress plugin Recapture for WooCommerce, affecting versions from n/a up to 1.0.43. Connected sources confirm the vulnerability type and impacted version range, but do not provide expl...
CVE-2025-1436
The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-13580
The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...
CVE-2025-25748
A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...
CVE-2025-2163
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
PT-2025-11348 · Undefined · Undefined
Four CVEs assigned: CVE-2025-2446 path traversal, CVE-2025-2439 GGUF parser read, CVE-2025-2445 Python-engine injection, CVE-2025-2447 missing CSRF...
CVE-2025-28912
Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...
CVE-2025-28927
Cross-Site Request Forgery CSRF vulnerability in A. Chappard Display Template Name display-template-name allows Cross Site Request Forgery.This issue affects Display Template Name: from n/a through = 1.7.1...