PT-2025-10947

Name of the Vulnerable Software and Affected Versions: Muntasir Rahman Custom Dashboard Page versions 1.0 and earlier Description: The issue is related to a cross-site request forgery CSRF problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker can trick a...

PT-2025-10915

Name of the Vulnerable Software and Affected Versions: Builder for Contact Form 7 by Webconstruct versions 1.2.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into...

CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

PT-2025-10916

Name of the Vulnerable Software and Affected Versions: smerriman Login Logger versions 1.2.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing...

PT-2025-10927

Name of the Vulnerable Software and Affected Versions: mg12 Mobile Themes versions n/d through 1.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows unauthorized actions to be performed on behalf of a user. This problem affects mg12 Mobile Themes,...

OpenMRS Cross-Site Request Forgery Vulnerability

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in OpenMRS version 2.4.3 that stems from a cross-site request forgery issue that could lead to the execution of arbitrary operations...

CVE-2025-25748: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-25748

HotelDruid version 3.0.7 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the gestione_utenti.php endpoint. The root cause is a lack of Origin or Referer header validation and the absence of required anti-CSRF tokens. This allows an attacker to perform unauthorized actions, such as mo...

PT-2025-10908

Name of the Vulnerable Software and Affected Versions: W3Counter Free Real-Time Web Stats versions prior to 4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows unauthorized actions to be performed on behalf of a user. This can be exploited by an attack...

PT-2025-10931

Name of the Vulnerable Software and Affected Versions: Fastmover Plugins Last Updated Column versions 0.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows unauthorized actions to be performed on behalf of a user. This is due to inadequate...

PT-2025-10940

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Select Box Editor Button versions 0.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into...

PT-2025-10930

Name of the Vulnerable Software and Affected Versions: xjb REST API TO MiniProgram versions prior to 4.7.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross-Site Request Forgery. This is a type of attack where an attacker can trick a user into...

PT-2025-10958

Name of the Vulnerable Software and Affected Versions: A. Chappard Display Template Name versions 1.7.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This type of atta...

Fortinet FortiSIEM security vulnerabilities

Fortinet FortiSIEM is a security information and event management system from Fortinet. The system includes features such as asset discovery, workflow automation, and unified management. A security vulnerability exists in Fortinet FortiSIEM that stems from improper authorization and could allow a...

CVE-2025-25748

A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...

CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4...

Tianti Cross-Site Request Forgery Vulnerability

tianti tianti is a JAVA lightweight CMS solution by jeffry personal developer. A security vulnerability exists in tianti v2.3. An attacker can perform arbitrary operations via specially crafted GET or POST requests...

CVE-2024-12610

The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mjsmgtremovefeetype' and 'mjsmgtremovecategorynew' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for...

CVE-2025-1362

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2025-1362

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...