PT-2025-20182 · Unknown · Lessbuttons Social Sharing/Statistics

Name of the Vulnerable Software and Affected Versions: LessButtons Social Sharing and Statistics versions 1.6.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved...

PT-2025-20038 · Unknown · Smart Manager

Name of the Vulnerable Software and Affected Versions: SmartManagerCN versions prior to SMR May-2025 Release 1 Description: The issue is related to improper access control, allowing local attackers to launch activities within the affected software. This could potentially lead to unauthorized acce...

Large Language Models Are Autonomous Cyber Defenders

Fast and effective incident response is essential to prevent adversarial cyberattacks. Autonomous Cyber Defense ACD aims to automate incident response through Artificial Intelligence AI agents that plan and execute actions. Most ACD approaches focus on single-agent scenarios and leverage...

PT-2025-20226 · Unknown · Smaily For Wp

Name of the Vulnerable Software and Affected Versions: Smaily for WP versions 3.1.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 3.1.6 and earlier,...

PT-2025-20208 · Unknown · Themarketer2023 Themarketer

Name of the Vulnerable Software and Affected Versions: themarketer2023 theMarketer versions 1.4.7 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Stored XSS. This means an attacker can execute malicious scripts on the victim's browser, potentially leading to unauthorized...

CVE-2025-46820

phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUBTOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the...

Vulnerabilities fixed in Keycloak

Red Hat has fixed vulnerabilities in Keycloak. The vulnerabilities include an issue where JWT tokens with long expiration times can cause infinite growth in the cache, resulting in an OutOfMemoryError and a Denial-of-Service for legitimate users. In addition, verification of trust store...

MAL-2025-3650 Malicious code in typescript-plugin-some-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d085d197d92c4b2e513d151403cdf29607fd2b87e7e6cce26231dd6a222e76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Plugin LayoutBoxx: Code Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2025-46820: Exposure of Sensitive Information to an Unauthorized Actor

phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUBTOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to Denial Of Service DoS. The vulnerability is due to missing validation of uniqueness and quantity of task actions in the UpdateRunTaskActions GraphQL operation, allowing attackers to overload the server by submitting excessive actions...

PT-2025-19726 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNEXT versions 14.74.3 through 14.82.1 Description: A Cross-Site Request Forgery CSRF vulnerability was discovered, allowing an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to...

CVE-2025-28062: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

CVE-2025-28062

A Cross-Site Request Forgery (CSRF) vulnerability exists in ERPNext versions 14.82.1 and 14.74.3 due to a lack of CSRF protections on critical management API endpoints. An attacker can exploit this to perform unauthorized actions on behalf of an authenticated administrator, including user deletio...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

ERPNext Cross-site Request Forgery Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a cross-site request forgery vulnerability that can be exploited by attackers to cause unauthorized operations...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

CVE-2024-13420

Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsfresetsectionoptions', 'gsfresetsectionoptions', 'gsfcreatepresetoptions' and more in various versions. This makes it possible for authenticated...