EUVD-2023-46887

Malicious code in bioql PyPI...

EUVD-2023-45604

Malicious code in bioql PyPI...

CVE-2025-23293

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure...

PT-2025-29761 · WordPress · Toast Plugins Animator

Name of the Vulnerable Software and Affected Versions: Toast Plugins Animator versions n/a through 3.0.16 Description: A Cross-Site Request Forgery CSRF issue exists in Toast Plugins Animator. This allows attackers to perform actions on behalf of unsuspecting users. Recommendations: Update Toast...

CVE-2024-9414

In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions...

CVE-2024-8434

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-12436

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2023-42435

The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user...

CVE-2021-24809

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bpbettermessagesleavechat, bpbettermessagesjoinchat, bpmessagesleavethread, bpmessagesmutethread, bpmessagesunmutethread, bpbettermessagesaddusertothread,...

CVE-2021-22227

A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it...

CVE-2020-19362

Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page...

CVE-2024-26273

Cross-site request forgery CSRF vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to 1 change user...

Checkmk NagVis Reflected Cross-site Scripting

Vulnerability Details Affected Vendor: Checkmk Affected Product: Checkmk/NagVis Affected Version: Checkmk 2.3.0p2, NagVis 1.9.40 Platform: GNU/Linux CWE Classification: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVE ID: CVE-2024-13722 2...

CVE-2024-54852

Teedy CVE-2024-54852 affects Teedy versions 1.9–1.12. The LDAP injection arises from improper sanitization of the username field in the LDAP login flow, enabling an unauthenticated attacker to perform actions such as creating arbitrary accounts and spraying passwords. Remediation: update LDAP han...

CVE-2023-31279

The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This could enable an attacker to configure, manage, a...

CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

Planex MZK-MF300N 安全漏洞

The Planex MZK-MF300N is a world's smallest class wireless LAN multi-pocket router from Planex Japan. A security vulnerability exists in the Planex MZK-MF300N. An attacker exploiting this vulnerability could perform unexpected actions...

Cross-Site Request Forgery (CSRF)

aim is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the lack of CSRF and CORS protection in the aim dashboard, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent...

Cross site request forgery (csrf)

The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user...

PT-2023-15197 · Unknown · Clickfunnels

Name of the Vulnerable Software and Affected Versions: ClickFunnels plugin versions = 3.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to...