CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

WordPress Appointmind plugin <= 4.0.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Appointmind versions = 4.0.0...

WordPress Amazon Associate Filter plugin <= 0.4 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Amazon Associate Filter versions = 0.4...

WordPress While Loading plugin <= 3.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin While Loading versions = 3.0...

CSRF ON SIGNUP PAGE

CSRF ON CREATING A NEW USER in mlflow/mlflow Reported on Oct 31st 2024 The Signup feature of Mlflow is vulnerable to CSRF attack that allow attacker to create a new account. This may be used to perform unauthorised actions on behalf of the malcious user . Proof of Concept : An attacker can use CS...

CVE-2024-43933

CVE-2024-43933 covers a CSRF to Stored XSS vulnerability in WPMobile.App (Android/iOS) affecting versions up to 11.48. Multiple sources confirm the issue as a Cross‑Site Request Forgery that enables stored XSS within the affected app. The vulnerability is documented across CVE repositories, Red H...

CVE-2024-43933 WordPress WPMobile.App plugin <= 11.48 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This issue affects WPMobile.App: from n/a through = 11.48...

CVE-2024-49674

CVE-2024-49674 : WordPress EKC Tournament Manager plugin (versions ≤ 2.2.1) has a Cross-Site Request Forgery (CSRF) vulnerability that allows uploading a web shell to the web server. Exploitation would enable an attacker to place arbitrary files on the server via CSRF, potentially leading to unau...

PT-2024-33638 · Smash Balloon · Smash Balloon Custom Twitter Feeds

Name of the Vulnerable Software and Affected Versions: Smash Balloon Custom Twitter Feeds Tweets Widget versions through 2.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into...

CVE-2024-48291

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=editAdmin&id=17...

CVE-2024-48291

CVE-2024-48291 affects dingfanzu CMS 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the admin action endpoint: /admin/doAdminAction.php?act=editAdmin&id=17. According to available sources, exploitation requires user interaction, with a CVSS v3.1 base score of 6.3 (MEDIUM) and lo...

PT-2024-16289 · Unknown · Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: Blood Bank Management System version 1.0 Description: A problematic issue has been found in the Blood Bank Management System, affecting some unknown functionality of the file /file/delete.php. The manipulation of the bid argument leads to...

Fortinet FortiWeb Insufficient protections against XSS and CSRF (FG-IR-23-068)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-068 advisory. - A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6...

WordPress AMP for WP Plugin <= 1.0.99.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software AMP for WP Type Plugin Vulnerable versions = 1.0.99.1 Fixed in 1.0.99.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9598 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 79afb46366eb Credits David Gallagher...

CVE-2024-10045

The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the processactions function. This makes it possible for unauthenticated attackers to delete transients via a...

GHSA-CHJ2-4VG7-HHG3 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently...