CVE-2025-65593

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery CSRF via the Schedule Tasks functionality...

EUVD-2025-203880

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the downloadpluginbulk and downloadthemebulk functions. This makes it possibl...

CVE-2025-14399

Technical details for CVE-2025-14399 are not publicly provided in the supplied documents; monitor for updates from Wordfence/WordPress vulnerability feeds.

CVE-2025-64700

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations...

CVE-2025-64700

CVE-2025-64700 affects GROWI up to v7.3.3, with a cross-site request forgery (CSRF) vulnerability that can trick a logged-in user into unintended operations when viewing a malicious page. Connected sources indicate the fix is to update to GROWI v7.3.4 (or later). The reports consistently describe...

EUVD-2025-203875

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations...

CVE-2025-64700

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations...

GROWI vulnerable to cross-site request forgery

Overview GROWI provided by GROWI, Inc. contains the following vulnerability. Cross-site request forgery CWE-352 - CVE-2025-64700 GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security...

CVE-2025-66953

CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically the /systemsetup.htm, /setclock.htm, /receiversetup.htm, /cal.htm?..., and /channelsetup.htm endpoints...

PT-2025-51862

Name of the Vulnerable Software and Affected Versions narda miteq Uplink Power Control Unit UPC2 version 1.17 Description A Cross-Site Request Forgery CSRF issue exists in the narda miteq Uplink Power Control Unit UPC2 version 1.17. A remote attacker can potentially execute arbitrary code through...

CVE-2025-67173

RiteCMS v3.1.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the page creation/editing functions that allows an attacker to arbitrarily create pages via a crafted POST request. Multiple sources corroborate that the issue arises from requests not adequately verifying the origin/intent o...

Ercom Cryptobox 安全漏洞

Ercom Cryptobox is an encrypted collaboration platform from the French company Ercom. A security vulnerability exists in Ercom Cryptobox that stems from susceptibility to cross-site request forgery attacks that could lead to an attacker executing operations as an administrator...

CVE-2025-67173

A Cross-Site Request Forgery CSRF in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request...

PT-2025-51820

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the download plugin bulk and download theme bulk functions. This makes it...

CVE-2025-66953

The CVE-2025-66953 issue affects the Narda MITEQ UPC2 Uplink Power Control Unit (UPC2, v1.17). The vulnerability is a CSRF flaw in the Web-based management interface that enables a remote attacker to execute arbitrary code via several endpoints, including /system_setup.htm, /set_clock.htm, /recei...

WordPress Download Plugins and Themes from Dashboard plugin <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival vulnerability

Cross-Site Request Forgery to Bulk Plugin/Theme Archival vulnerability discovered by bosz in WordPress Plugin Download Plugins and Themes from Dashboard versions = 1.9.6...

PT-2025-51807

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations...

PT-2025-51857

A Cross-Site Request Forgery CSRF in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request...

PT-2025-51831

CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack requires the administrator to browse a malicious web site or to click a link while he has an open session on the administration console...

WordPress plugin Download Plugins and Themes in ZIP from Dashboard 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...