22796 matches found
MAL-2025-143358 Malicious code in html-webpack-plugin-csrf-link-changelog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 922ca18a44731d301d1740519b17256d39a472601f460a03933bf194565d2642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-140764 Malicious code in chromedriver-csrf-ariel-hapi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3b7bcbb5c91af68f2226ee73e0f82d0975d4f5cb57c97087eab99276a369e04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-114242
Malicious code in elara-centauri-csrf-unuk npm...
EUVD-2025-123359
Malicious code in process-parcel-pino-pretty-csrf npm...
EUVD-2025-114814
Malicious code in csrf-pulsar-config-centaurus npm...
EUVD-2025-113937
Malicious code in eris-firebase-uglify-js-csrf npm...
EUVD-2025-114120
Malicious code in eleventy-aurora-csrf-semantic-release npm...
EUVD-2025-116579
Malicious code in apollo-non-blocking-local-csrf npm...
EUVD-2025-116727
Malicious code in andromeda-csrf-got-tool npm...
EUVD-2025-120625
Malicious code in wasat-vuepress-quantum-csrf npm...
EUVD-2025-116558
Malicious code in aquarius-perseus-cross-env-csrf npm...
EUVD-2025-111213
Malicious code in meteor-chalk-csrf-sagitta npm...
CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
CVE-2025-12901
The CVE-2025-12901 entry concerns the WordPress plugin Asgaros Forum. Reports across multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 3.2.1 caused by missing nonce validation in the set_subscription_level() function, enabling unauthenticated attacke...
WordPress Asgaros Forum plugin <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update vulnerability
Cross-Site Request Forgery to Subscription Settings Update vulnerability discovered by Brian Mungai in WordPress Plugin Asgaros Forum versions = 3.2.1...
CVE-2025-12132
The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclplsave functionality. This makes it possible for unauthenticated attackers to modify...
CVE-2025-12589
The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possibl...
CVE-2025-11886
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
