Linux Distros Unpatched Vulnerability : CVE-2024-51487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens wh...

Linux Distros Unpatched Vulnerability : CVE-2020-11825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user'...

Linux Distros Unpatched Vulnerability : CVE-2016-10522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - railsadmin ruby gem v1.1.1 is vulnerable to cross-site request forgery CSRF attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attack...

Linux Distros Unpatched Vulnerability : CVE-2021-39209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery CSRF...

Linux Distros Unpatched Vulnerability : CVE-2021-41260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross...

PT-2025-37022

Name of the Vulnerable Software and Affected Versions: WP Blast | SEO & Performance Booster plugin for WordPress versions up to and including 1.8.6 Description: The WP Blast | SEO & Performance Booster plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect...

PT-2025-37024

Name of the Vulnerable Software and Affected Versions: Maspik – Ultimate Spam Protection plugin for WordPress versions through 2.5.6 Description: The Maspik – Ultimate Spam Protection plugin for WordPress is susceptible to a Cross-Site Request Forgery issue. This is due to insufficient or incorre...

Linux Distros Unpatched Vulnerability : CVE-2022-48320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site Request Forgery CSRF in Tribe29's Checkmk = 2.1.0p17, Checkmk = 2.0.0p31, and all versions of Checkmk 1.6.0 EOL allow an attacker to add new visual...

Linux Distros Unpatched Vulnerability : CVE-2022-26309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation User operation resulting in elevation of privilege to Administrator group...

WordPress plugin WP Blast | SEO & Performance Booster 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress WP Blast plugin <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing vulnerability

Cross-Site Request Forgery to Cache Clearing vulnerability discovered by Nabil Irawan in WordPress Plugin WP Blast versions = 1.8.6...

listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover

Summary Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering such as sending a link via email or chat, an attacker may trick the users of a web...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the templates/preview process. An attacker can execute arbitrary JavaScript code in the context of an authenticated user's browser by crafting a malicious HTML page that submits a POST request without...

CVE-2025-58430

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...

CVE-2025-58430

CVE-2025-58430 affects listmonk (up to version 1.1.0). The vulnerability arises because each HTTP request includes a nonce in addition to the session cookie, and the nonce value is not checked/validated by the backend, enabling request forgery. When chained with other flaws (CSRF and XSS), this c...

CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...

CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...

CVE-2025-54256

Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must click on a malicious link, and...

CVE-2025-54256

Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must click on a malicious link, and...

CVE-2025-54256

Dreamweaver Desktop (Windows/macOS) is affected by CVE-2025-54256: CSRF that could allow arbitrary code execution in the context of the current user. Affected: Dreamweaver Desktop versions 21.5 and earlier. Root cause described in the CVE as a Cross-Site Request Forgery vulnerability that require...