EUVD-2026-54515

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

Siemens SICAM 8 product authorization issue and vulnerabilities

The Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. The Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation...

CVE-2026-54801

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.20, SICORE Base system All versions V26.20.0. The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the we...

CVE-2026-54801

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.20, SICORE Base system All versions V26.20.0. The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the we...

CVE-2026-50881

Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Administrator and execute unauthorized account, password, and configuration changes...

CVE-2018-25354 Joomla Component jomres 9.11.2 Cross-Site Request Forgery

Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated users into visiting malicious pages. Attackers can craft HTML forms targeting the account/index endpoint with hidden fields to chan...

Joomla jCart for OpenCart 跨站请求伪造漏洞

Joomla jCart for OpenCart is an open-source extension that integrates Joomla with OpenCart. It’s a e-commerce shopping cart extension. Version 2.3.0.2 of Joomla jCart for OpenCart contains a cross-site request forgeing vulnerability. This vulnerability stems from cross-site request forgery,...

CVE-2026-31014

Versions prior to 4.0.0.5 of Dovestones Softwares AD Self Update (a self-service catalog information update tool by Infoopia) are vulnerable to Cross-Site Request Forgery (CSRF) . The root cause is the lack of CSRF token protection at the affected endpoint, which processes state-changing requests...

Infoopia Dovestones AD Self Update 安全漏洞

Infoopia Dovestones AD Self Update is a self-service catalog information update tool developed by the Canadian company Infoopia. Versions of Infoopia Dovestones AD Self Update prior to 4.0.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the lack of CSRF token protection...

EUVD-2026-17106

An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...

CVE-2026-33373

An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...

CVE-2025-64063

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...

CVE-2025-64063

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw (CWE-285 ) where API endpoints fail to enforce sufficient access controls. A standard user can bypass UI restrictions by sending direct HTTP requests to administrative endpoints. This allows for unauthorized acc...

EUVD-2024-16859

Malicious code in bioql PyPI...

EUVD-2021-34173

Malicious code in bioql PyPI...

PT-2025-38589

Name of the Vulnerable Software and Affected Versions StorageGRID versions prior to 11.8.0.15 StorageGRID versions prior to 11.9.0.8 Description StorageGRID formerly StorageGRID Webscale is susceptible to a Reflected Cross-Site Scripting issue. Successful exploitation could allow an attacker to...

CVE-2025-56710

A Cross-Site Request Forgery CSRF vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This flaw allows an attacker to trick authenticated users into unintentionally modifying their account details. By crafting a malicious HTML page, ...

PT-2025-37487

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student-Result-Management-System-Using-PHP-V2.0 version 2.0 Description: A Cross-Site Request Forgery CSRF flaw exists in the Profile Page of the software. This allows an attacker to trick authenticated users into unintentionally...

CVE-2024-1084

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all...

CVE-2024-13513

The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's...