Ash Authentication 安全漏洞

Ash Authentication is an Ash authentication framework open-sourced by Alembic. A security vulnerability exists in Ash Authentication versions prior to 4.1.0 through 4.4.9, which stems from the presence of a token validation flaw that can lead to reusable magic link tokens...

CVE-2022-24879

Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery CSRF token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7....

CVE-2022-22990

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts...

CVE-2024-1740

In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which...

CVE-2024-9931

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the fir...

CVE-2024-9861

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated...

CVE-2024-45032

A vulnerability has been identified in Industrial Edge Management Pro All versions V1.9.5, Industrial Edge Management Virtual All versions V2.3.1-1. Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices...

PT-2025-5248 · Sablab · Sablab Internal Link Builder

Name of the Vulnerable Software and Affected Versions: Alessandro Piconi - SabLab Internal Link Builder versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user...

PT-2025-5398 · Post Meta · Post Meta

Name of the Vulnerable Software and Affected Versions: Post Meta versions 1.0.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-048)

The version of runfinch-finch installed on the remote host is prior to 1.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-048 advisory. An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its...

PT-2025-5100 · David Hamilton · Orangebox

Name of the Vulnerable Software and Affected Versions: David Hamilton OrangeBox versions n/a through 3.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions...

PT-2025-4883 · Easy Tynt · Easy Tynt

Name of the Vulnerable Software and Affected Versions: Easy Tynt versions 0.2.5.1 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue can be exploited to perform Cross Site Request Forgery. Recommendations: F...

PT-2025-4543 · Unknown · Affiliate Disclosure Statement

Name of the Vulnerable Software and Affected Versions: Affiliate Disclosure Statement versions n/a through 0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This is a type of attack where an attacker tricks a user into performing...

PT-2025-2517 · Metorik · Metorik

Name of the Vulnerable Software and Affected Versions: Metorik – Reports & Email Automation for WooCommerce versions 1.7.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. The estimated number of potentially affected devices...

PT-2025-3217 · Unknown · Event Espresso 4 Decaf

Name of the Vulnerable Software and Affected Versions: Event Espresso 4 Decaf versions prior to 5.0.28.decaf Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2024-36296 · Unknown · Xpd Reduce Image Filesize

Name of the Vulnerable Software and Affected Versions: XPD Reduce Image Filesize versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a we...

PT-2024-36275 · Eduardo Chiaro · Addweather

Name of the Vulnerable Software and Affected Versions: Eduardo Chiaro addWeather versions n/a through 2.5.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.5.1, consider implementing prop...

PT-2024-36306 · Unknown · Dtc Documents

Name of the Vulnerable Software and Affected Versions: DTC Documents versions 1.1.05 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on a...

Exploit for Improper Handling of Missing Values in Metagauss Registrationmagic

Unauthenticated Privilege Escalation via Password Recovery o...

CVE-2023-0657

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...