7 matches found
CVE-2026-11603
The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'argsfilterFormArray' Parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
gorilla/csrf CSRF vulnerability due to broken Referer validation
Summary gorilla/csrf is vulnerable to CSRF via form submission from origins that share a top level domain with the target origin. Details gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it...
CVE-2020-23585
A remote attacker can conduct a cross-site request forgery CSRF attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgmconfigfile.asp" because of which attacker can create a crafted "csrf for...
Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRF
The plugin does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues Make a logged in admin open a page...
WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF Date: 2/10/2021 Author: 0xB9 Software Link: https://wordpress.org/plugins/database-backups/ Version: 1.2.2.6 Tested on: Windows 10 CVE: CVE-2021-24174 1. Description: This plugin allows admins to create and...
Weblate: Account Takeover using Third party Auth CSRF
Login to your account at demo.weblate.org 2. Goto Profile Authentication - https://demo.weblate.org/accounts/profile/auth 3. In Add new association section , select Ubuntu 4. Login with Ubuntu One account , before clicking on Yes log me in on ubuntu authentication site , start a proxy tool like...
Wordpress Multimedia1 Themes CSRF Vulnerability
Exploit for php platform in category web applications Wordpress Themes Multimedia1 Shell Upload Vulnerability | CSRF Author : Berandal Google Dork: inurl:/wp-content/themes/multimedia1/ Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ +-+-+-+-+-+-+-+-+ |B|e|r|a|n|d|a|l| +-+-+-+-+-+-+-+-+ ...