PT-2024-34476 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/doAdminAction.php?act=addAdmin component. This allows for attacker-controlled admin creation, resulting in unauthorized privileged...

CVE-2024-50966

CVE-2024-50966 affects dingfanzu CMS v1.0 via the /admin/doAdminAction.php?act=addAdmin endpoint, where a CSRF flaw allows attacker-controlled creation of admin accounts, yielding unauthorized privileged access. Root cause: CSRF in admin-action handling. Impact: high confidentiality and integrity...

CVE-2024-48291

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=editAdmin&id=17...

CVE-2024-48291

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=editAdmin&id=17...

CVE-2024-48191

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/doAdminAction.php?act=delAdmin&id=17...

dingfanzu 安全漏洞

dingfanzu is a php-based takeaway ordering website by gk2007 individual developer. A security vulnerability exists in dingfanzu version 1.0, which originates from /admin/doAdminAction.php?act=editAdmin&id=17 contains a cross-site request forgery vulnerability...

PT-2024-39711 · WordPress · Amp For Wp – Accelerated Mobile Pages

Name of the Vulnerable Software and Affected Versions: AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to, and including, 1.0.99.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the proxy function. This allows...

CVE-2023-6243

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admintestemail function. This makes it possible for unauthenticated...

CVE-2024-48758

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the addPro parameter of the component doAdminAction.php which allows a remote attacker to execute arbitrary code...

PT-2024-39071 · WordPress · The Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is related to Cross-Site Request Forgery CSRF...

CVE-2024-46600

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/doAdminAction.php?act=delCate&id=31...

CVE-2024-46485

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=addCate...

CVE-2024-46600

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/doAdminAction.php?act=delCate&id=31...

PT-2024-32068 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/admin/doAdminAction.php" API endpoint, specifically when the act parameter is set to delCate and the...

PT-2024-12208 · WordPress · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS plugin for WordPress versions up to, and including, 2.7.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addon enable disable function. This allows unauthenticated...

PT-2024-37906 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The issue is related to a lack of CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such actions via a CSRF attack...

CVE-2024-3983

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-3643

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3642

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3631

CVE-2024-3631 affects the HL Twitter WordPress plugin (versions up to 2014.1.18). The issue is a missing CSRF check when unlinking Twitter accounts, enabling an attacker to cause logged-in admins to perform unlink actions via CSRF. This is the root cause and the primary impact stated in connected...