CVE-2025-53895

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission chec...

CVE-2025-53895 ZITADEL has broken authN and authZ in session API and resulting session tokens

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission chec...

PT-2025-27663

Name of the Vulnerable Software and Affected Versions: NS3000 versions 7.x through 8.1.1.125110 NS2000 version 7.02.08 Description: The issue is related to missing authentication checks in the "query.fcgi" endpoint, which allows attackers to execute a session hijacking attack. Recommendations: Fo...

CVE-2021-20851

CVE-2021-20851 affects the WordPress plugin Browser and Operating System Finder (versions prior to 1.2). The vulnerability is a CSRF flaw in the plugin that can allow an administrator, when viewing a malicious page while logged in, to perform unintended actions, possibly hijacking the admin’s ses...

CVE-2018-8814

WolfCMS 0.8.3.1 is affected by CVE-2018-8814: a Cross-site request forgery (CSRF) vulnerability that allows an attacker to hijack user authentication for requests that modify plugin/[pluginname]/settings. The issue arises in WolfCMS before 0.8.3.1 and can be triggered by crafting malicious reques...

OpenCMS 10.5.3 - Cross-Site Request Forgery

Exploit Title: OpenCMS 10.5.3 Multiple Cross Site Request Forgery Vulnerabilities Injection Google Dork: N/A Date: 02-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.opencms.org/en/ Software Link:...

PT-2018-18220

Name of the Vulnerable Software and Affected Versions: SecurEnvoy SecurMail versions prior to 9.2.501 Description: The issue allows remote attackers to hijack the authentication of arbitrary users for requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities...

CVE-2012-0699

Multiple cross-site request forgery CSRF vulnerabilities in Family Connections CMS aka FCMS 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that 1 add news via an add action to familynews.php or 2 add a prayer via an add action to prayers.php...

CVE-2017-5492

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

PT-2017-16517

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 2.4 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users. This is demonstrated by exploitation of the following API endpoints: "admin/add user.lua"...

PT-2016-4818

Name of the Vulnerable Software and Affected Versions Cisco Small Business 220 devices with firmware before 1.0.1.1 Description A cross-site request forgery CSRF issue exists in the web-based management interface, allowing remote attackers to hijack the authentication of arbitrary users...

CVE-2016-2889

The CVE-2016-2889 entry concerns a CSRF vulnerability in IBM Jazz Reporting Service (JRS) affecting Report Builder and Data Collection Component (DCC). Affected products/versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0, as well as 6.0.1 before their respective fixes, with Jazz Re...

PT-2016-5639

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager versions prior to 12.1 RU6 MP5 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in management scripts. These vulnerabilities allow remote authenticated users to hijack...

PT-2016-4617

Name of the Vulnerable Software and Affected Versions baserCMS Casebook plugin versions prior to 0.9.4 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. Recommendations For versions prior to 0.9.4, update to version 0.9.4 or lat...

CVE-2016-1168

CVE-2016-1168 affects NEC Aterm WF800HP devices with firmware version 1.0.17 and earlier. The vulnerability is a Cross-site Request Forgery (CSRF) that can allow a logged-in user to be coerced into performing unintended actions when visiting a malicious page, potentially hijacking the user’s auth...

CVE-2015-2134

Cross-site request forgery CSRF vulnerability in HP System Management Homepage SMH before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-3388

CVE-2015-3388 affects Drupal’s Commerce Balanced Payments module. A CSRF flaw allows an attacker to hijack a user’s session to trigger requests that delete the user’s configured bank accounts via unspecified vectors. Public advisories indicate CSRF (and related XSS) in Commerce Balanced Payments ...

PT-2015-6187

Name of the Vulnerable Software and Affected Versions Alfresco module versions prior to 6.x-1.3 for Drupal Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node. Recommendations For...

CVE-2014-6214

IBM WebSphere Portal is affected by a CSRF/XSRF vulnerability in versions 8.0.0.x before 8.0.0.1 CF15 and 8.5.0 before CF05, allowing remote attackers to hijack user authentication for requests that insert XSS sequences. The issue stems from improper validation of user-supplied input, enabling au...

CVE-2015-2089

CVE-2015-2089 concerns the CrossSlide jQuery plugin for WordPress (version 2.0.5 and earlier). The vulnerability arises from CSRF flaws in the plugin’s admin flow: parameters such as csj_width, csj_height, csj_sleep, csj_fade, and upload_image pass through the thisismyurl_csj.php page to wp-admin...