69244 matches found
CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...
CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...
CLEANSTART-2023-ZI26897 CSRF check issue exists in ZoneMinder through 1
Security vulnerability affects the zoneminder package. A CSRF check issue exists in ZoneMinder through 1...
CLEANSTART-2025-AK96044 cross-site request forgery (CSRF) vulnerability in Jenkins 2
Security vulnerability affects the jenkins package. A cross-site request forgery CSRF vulnerability in Jenkins 2...
CLEANSTART-2025-IK70728 Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1
Security vulnerability affects the gitea-fips package. Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1...
CLEANSTART-2025-XK90952 CSRF issue in phpMyAdmin 4
Security vulnerability affects the phpmyadmin package. A CSRF issue in phpMyAdmin 4...
CVE-2026-96632
AdminNeo inserts the database server's version string into a "" tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a val...
CVE-2026-96629
AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recover the...
CVE-2026-120205: Thelia: Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...
PT-2026-134524
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...
FreeBSD : phpMyAdmin -- Multiple vulnerabilities, no fix available (e6b90d23-d49d-11f1-bae2-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b90d23-d49d-11f1-bae2-3497f65b111b advisory. VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were publishe...
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...
GHSA-WM25-49W3-5QRG AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...
CLEANSTART-2026-JV71156 It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
Security vulnerability affects the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session...
CVE-2026-65566
Cross-Site Request Forgery CSRF vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8...
CVE-2026-119466
Cross-Site Request Forgery CSRF vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...
EUVD-2026-114190
Cross-Site Request Forgery CSRF vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin APIExperts Square for WooCommerce versions = 4.7.5...
CVE-2026-65566 WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8...