CVE-2025-9884

The CVE-2025-9884 entry concerns the WordPress plugin Mobile Site Redirect (versions up to and including 1.2.1). The issue is a Cross-Site Request Forgery (CSRF) that, due to missing or incorrect nonce validation, can allow unauthenticated attackers to induce a site administrator to perform actio...

EUVD-2025-32282

The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for...

CVE-2025-10311

CVE-2025-10311 affects the WordPress plugin Comment Info Detector (versions

PT-2025-40507

Name of the Vulnerable Software and Affected Versions Restrict User Registration plugin for WordPress versions prior to 1.0.2 Description The Restrict User Registration plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of proper nonce validation within th...

PT-2025-40492

Name of the Vulnerable Software and Affected Versions WordPress TextBuilder plugin versions 1.0.0 through 1.1.1 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation. An unauthenticated attacker can update a user's authorization token b...

PT-2025-40498

Name of the Vulnerable Software and Affected Versions WP SinoType plugin for WordPress versions prior to 1.1 Description The WP SinoType plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of or incorrect nonce validation in the sinotype config function. An...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations by Nilson Lazarin Individual Developer. A security vulnerability exists in WeGIA 3.4.12 and prior versions that stems from improper access control and could allow an unauthenticated attacker to gain direct access to sensitive information...

Cisco Firepower Threat Defense Software Encrypted Archive File Policy Bypass (cisco-sa-ftd-archive-bypass-z4wQjwcN)

A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. This vulnerability exists because of a...

WordPress plugin Schema & Structured Data for WP & AMP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-35034

Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portletuserid' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14...

CVE-2025-35030

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...

CVE-2025-57878

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

CVE-2025-9946 LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-9948 Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...

CVE-2025-35030

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...

CVE-2025-35030 Medical Informatics Engineering Enterprise Health cross site request forgery

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...

CVE-2025-57879 BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

Privilege Escalation

sap/xssecis vulnerable to Privilege Escalation. The vulnerability is due to a flaw where the library can incorrectly accept or elevate security context from untrusted input, and an unauthenticated attacker can exploit this by sending specially crafted requests or tokens to obtain arbitrary...

Medical Informatics Engineering Enterprise Health 安全漏洞

Medical Informatics Engineering Enterprise Health is a healthcare solution from US-based Medical Informatics Engineering. A security vulnerability exists in Medical Informatics Engineering Enterprise Health that stems from susceptibility to cross-site request forgery attacks that could lead to an...

CVE-2025-10498

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated...