CVE-2025-1362 easy-broken-link-checker <= 9.0.2 - Bulk Actions via CSRF

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2025-1362

CVE-2025-1362 affects the WordPress plugin URL Shortener | Conversion Tracking | AB Testing | WooCommerce (≤ 9.0.2). The root cause is missing CSRF checks in certain bulk actions, enabling an attacker with user login who can trick an admin into performing unintended actions (e.g., deleting custom...

CVE-2024-13816 Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This mak...

GHSA-C39W-3PJX-QC7M Leantime allows Stored Cross-Site Scripting (XSS)

Description Leantime allows stored cross-site scripting XSS in the API key name while generating the API key. Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading t...

PT-2025-7644 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime affected versions not specified Description: The issue allows stored cross-site scripting XSS in the API key name while generating the API key. Any low-privileged user, such as a manager or editor, can create an API key with an XSS...

CVE-2024-27312

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

PT-2025-34811 · Telpo · Telpo Mdm

Name of the Vulnerable Software and Affected Versions: Telpo MDM versions 1.4.6 through 1.4.9 Description: The Telpo MDM Android platform stores sensitive administrator credentials and MQTT server connection details IP/port in plaintext within log files on the device's external storage. This allo...

CVE-2025-22220

VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user...

CVE-2024-57611

CVE-2024-57611 affects 07FLYCMS V1.3.9 and is associated with a Cross-Site Request Forgery (CSRF) vulnerability reachable via admin/doAdminAction.php?act=editShop&shopId. The connected sources corroborate a CSRF issue in this version, but there is no public detail in the provided documents about ...

CVE-2024-57611

07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery CSRF via admin/doAdminAction.php?act=editShop&shopId...

CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

CVE-2024-12279

The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a...

CVE-2024-37774

A Cross-Site Request Forgery CSRF in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens...

PT-2024-22291 · Image Access Gmbh · Scan2Net

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application is not protected against cross-site request forgery attacks, allowing an attacker to trick users into performing actions on the...

CVE-2024-51381

Summary: CVE-2024-51381 is a CSRF flaw in JATOS v3.9.3 that lets attackers perform administrator-only actions, including creating admin accounts. The Red Hat, NVD, OSV, CNNVD, and CVE records corroborate the issue across sources. Affected component/version: JATOS 3.9.3. Root cause / nature: Cross...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the getExcludedPathsJSONArray function, which is populated by the plbackurl parameter in the content page editor. An attacker can perform administrative actions, execute arbitrary code, and alter user...