19060 matches found
Cross-Site Request Forgery (CSRF)
typo3/cms-lowlevel is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper handling of deep links in the backend user interface, caused by insufficient enforcement of HTTP methods and reliance on misconfigured security settings and allows an attacker to manipulate...
PT-2025-5023
Name of the Vulnerable Software and Affected Versions Callum Richards Admin Menu Organizer versions n/a through 1.0.1 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means an...
CVE-2024-56924
A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...
CVE-2024-56924
The Code Astro Internet banking system version 2.0.0 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is the lack of CSRF protection mechanisms on the account modification page (specifically pages_account.php ), allowing remote attackers to perform unauthorized ...
CVE-2024-56924
A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...
CVE-2025-21550
CVE-2025-21550 affects Oracle Financial Services Behavior Detection Platform (Web UI) within Oracle Financial Services Applications. The vulnerable software versions are 8.0.8.1, 8.1.2.7, and 8.1.2.8. The issue allows an unauthenticated attacker with network access via HTTP to compromise the plat...
CVE-2025-24001
Cross-Site Request Forgery CSRF vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through = 0.1.3...
CVE-2025-24001
CVE-2025-24001 : CSRF can lead to Stored XSS in the WordPress plugin “PPO Call To Actions” (PPO Call To Actions) versions up to 0.1.3. Initial description lists a CVSS v3.1 base score of 7.1 (HIGH) with NETWORK attack vector, UI needed, and changed scope; impact is Confidentiality/Integrity/Avail...
CVE-2025-24001 WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through = 0.1.3...
CVE-2025-24001 WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through = 0.1.3...
MAL-2025-312 Malicious code in site-picker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08f1194c6e49d7adf88a2a70415fcd789fab720cf63e7121963cff8fe1195fc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-Site Request Forgery (CSRF)
typo3/cms-beuser is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper handling of state-changing actions in downstream components, where HTTP GET submissions are incorrectly accepted instead of enforcing the appropriate HTTP method. Misconfigurations, such as...
WordPress plugin PPO Call To Actions: Cross-site Request Forgery vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2024-54792
A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...
PT-2025-5256 · Unknown · Ppo Call To Actions
Name of the Vulnerable Software and Affected Versions: PPO Call To Actions versions 0.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects PPO Call To Actions, allowing unauthorized requests. The estimated number of potentially affected devices worldwide is not specified...
CVE-2025-24001: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through = 0.1.3...
CVE-2024-22348
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...
IBM DevOps Velocity and IBM UrbanCode Velocity security vulnerabilities
IBM DevOps Velocity and IBM UrbanCode Velocity are both products of International Business Machines IBM.IBM DevOps Velocity is an enterprise-class release management application that supports cloud-native and local deployments.IBM UrbanCode Velocity is an enterprise-class release management and...
CVE-2024-22348: Permissive Cross-domain Policy with Untrusted Domains
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...