CVE-2024-12008 W3 Total Cache <= 2.8.1 Information Exposure via Log Files

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For exampl...

CVE-2024-12008 W3 Total Cache <= 2.8.1 Information Exposure via Log Files

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For exampl...

PT-2025-2890

Name of the Vulnerable Software and Affected Versions GestioIP version 3.5.7 Description The ip do job request is vulnerable to Cross-Site Scripting XSS, allowing data exfiltration and enabling CSRF attacks. The vulnerability requires specific user permissions within the application to exploit...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

CVE-2024-50861

The ipmoddnskeyform.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks...

PT-2025-3150 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptibl...

PT-2025-3144 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptibl...

PT-2025-3152 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible to Cross-Site Request Forgery CSRF. State-changing actions in...

PT-2025-2757 · Siemens · Simatic S7-1200 Cpu +1

Name of the Vulnerable Software and Affected Versions: SIMATIC S7-1200 CPU versions 1211C through 1217C SIPLUS S7-1200 CPU versions 1212 through 1215 Description: The web interface of the affected devices is vulnerable to Cross-Site Request Forgery CSRF attacks. This could allow an unauthenticate...

Siemens SIMATIC S7-1200 CPUs

SUMMARY The web interface of SIMATIC S7-1200 CPUs before V4.7 is affected by a cross-site request forgery CSRF vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL RECOMMENDATIONS As a general security measure,...

CVE-2024-50861

GestioIP v3.5.7 is affected by a Stored XSS in the ip_mod_dns_key_form.cgi flow. An attacker can inject code into the TSIG Key field, which is stored in the database and triggers XSS when the DNS Key page is viewed, enabling data exfiltration and CSRF. The Red Hat CVE entry and Exploit/packetstor...

CVE-2024-50857

The ipdojob request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting XSS. It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully...

PT-2025-3148 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptibl...

CVE-2024-50857

GestioIP v3.5.7 is affected by a reflected XSS in the ip_do_job request, caused by unsanitized input. Exploitation requires specific user permissions and can lead to data exfiltration and CSRF. Practical details and patches are referenced in multiple sources (Nuclei template, CVE writeups, and ad...

CVE-2025-22506 WordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SmartAgenda Smart Agenda allows Stored XSS.This issue affects Smart Agenda: from n/a through 4.7...

CVE-2025-22506 WordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through = 4.7...

CVE-2025-22963

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin...

CVE-2025-22963

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin...

CVE-2025-22963

CVE-2025-22963 affects Teedy up to version 1.11. The issue is a CSRF vulnerability that permits account takeover via POST /api/user/admin. Several connected sources confirm the affected software and the vulnerable endpoint, with Red Hat/Redundant feeds and PT-2025-4751 noting a workaround (restri...

CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once...