PT-2025-15416 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealership & Classified Listings Plugin versions up to, and including, 1.4.66 Description: The issue allows authenticated attackers with Subscriber-level access and above to execute several initial set-up actions due to a missing...

PT-2025-15420 · Unknown · Melapress Login Security Premium +1

Name of the Vulnerable Software and Affected Versions: MelaPress Login Security and MelaPress Login Security Premium versions 2.1.0 Description: The issue is related to unauthorized loss of data due to a missing capability check on the monitor admin actions function. This allows unauthenticated...

WordPress plugin MelaPress Login Security和WordPress plugin MelaPress Login Security Premium 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Security Updates for Microsoft OneNote Products (April 2025)

The Microsoft OneNote Products are missing a security update. They are, therefore, affected by a security feature bypass vulnerability. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application. Note that...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

CVE-2025-31479

canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...

CVE-2024-56474

IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2025-32272

Cross-Site Request Forgery CSRF vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through = 1.0.46...

CVE-2025-32265

Cross-Site Request Forgery CSRF vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through = 2.3.9...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

PT-2025-15017 · Berocket · Berocket Sequential Order Numbers For Woocommerce

Name of the Vulnerable Software and Affected Versions: BeRocket Sequential Order Numbers for WooCommerce versions 3.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be...

PT-2025-15026 · Pickplugins · Pickplugins Wishlist

Name of the Vulnerable Software and Affected Versions: PickPlugins Wishlist versions 1.0.44 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 1.0.44 and...

PT-2025-14910 · Otwthemes · Otwthemes Sidebar Manager Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Sidebar Manager Light versions 1.1.8 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricki...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

PT-2025-15031 · Riovizual · Table Block

Name of the Vulnerable Software and Affected Versions: Table Block by RioVizual versions prior to 2.1.8 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions prior to...

PT-2025-15019 · Jobwp · Jobwp

Name of the Vulnerable Software and Affected Versions: JobWP versions 2.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 2.3.9 and earlier, update to a versio...

PT-2025-15006 · Rollbar · Rollbar

Name of the Vulnerable Software and Affected Versions: Rollbar versions n/a through 2.7.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions prior to 2.7.1, update t...

BIT-JOOMLA-2020-8419

An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities...

BIT-JOOMLA-2020-10238

An issue was discovered in Joomla! before 3.9.16. Various actions in comtemplates lack the required ACL checks, leading to various potential attack vectors...