EUVD-2025-200254

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition because of a lack of integrity protection...

CVE-2025-59700

The Entrust nShield Connect XC , nShield 5c , and nShield HSMi hardware security modules, running firmware versions through 13.6.11 or 13.7 , are vulnerable to unauthorized modification of the Recovery Partition . This issue stems from a lack of integrity protection , allowing a physically proxim...

PT-2025-48701

Name of the Vulnerable Software and Affected Versions Entrust nShield Connect XC versions through 13.6.11 Entrust nShield 5c versions through 13.6.11 Entrust nShield HSMi versions through 13.6.11 Entrust nShield Connect XC version 13.7 Entrust nShield 5c version 13.7 Entrust nShield HSMi version...

PT-2025-47111

Name of the Vulnerable Software and Affected Versions Chunghwa Telecom TenderDocTransfer affected versions not specified Description The application establishes a local web server and offers APIs for communication. A lack of CSRF protection in the APIs allows unauthenticated remote attackers to...

SourceCodester Simple Public Chat Room 安全漏洞

SourceCodester Simple Public Chat Room is a simple public chat room in SourceCodester open source. A security vulnerability exists in SourceCodester Simple Public Chat Room version 1.0, which stems from the sendmessage.php endpoint that does not implement a CSRF protection mechanism, which could...

CVE-2025-11154

The IDonate WordPress plugin (versions before 2.1.13 ) is vulnerable to an unauthenticated user deletion flaw. The root cause is a lack of proper authorization and Cross-Site Request Forgery (CSRF) protection within an action handler used for deleting users. This allows unauthenticated attackers ...

CVE-2025-11154 IDonate < 2.1.13 - Unauthenticated User Deletion

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users...

The vulnerability of the Joomla! content management system lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute malicious code remotely.

The vulnerability of the Joomla! website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute remote code...

EUVD-2021-11467

Malware in sbrugna...

EUVD-2022-34535

Malicious code in bioql PyPI...

The vulnerability of the ColdFusion software platform, related to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-0520

The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin,...

CVE-2023-2627

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings...

CVE-2022-36670

PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable...

CVE-2024-8082

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-7297

The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2025-54829

Name of the Vulnerable Software and Affected Versions utls versions prior to 1.7.0 Description The utls software did not implement the TLS 1.3 downgrade protection mechanism as specified in RFC 8446 Section 4.1.3 when a utls ClientHello specification was used. This allowed a network attacker to...

Linux Distros Unpatched Vulnerability : CVE-2024-42146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add outer runtimepm protection to xelivektest@xedmabuf Any kunit doing any memory...

CVE-2024-54851

Teedy versions 1.12 and earlier are vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of proper CSRF protection mechanisms. This flaw could allow an attacker to perform unauthorized actions on behalf of a user. As of the current reports, there is no information regarding a newer versi...

Chunghwa Telecom TenderDocTransfer 安全漏洞

Chunghwa Telecom TenderDocTransfer is an application from Chunghwa Telecom China. A security vulnerability exists in Chunghwa Telecom TenderDocTransfer, which stems from the presence of arbitrary file writes and lack of CSRF protection, as well as a relative path traversal vulnerability in the AP...