PT-2024-38123 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.0 Description: A problematic issue was found in the Password Change Handler component, specifically in the /member.php?action=chgpwdsubmit file. The manipulation of the newpwd and newpwd2 arguments leads to cross-site reques...

CVE-2024-6490

During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10...

CVE-2024-6244

The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-6244

CVE-2024-6244 affects PZ Frontend Manager for WordPress (versions before 1.0.6). The root cause is missing CSRF checks in some areas, enabling CSRF attacks to coerce logged-in users into unintended actions (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base 8.8). The issue can be exploited witho...

PT-2024-37476 · WordPress · Pz Frontend Manager

Name of the Vulnerable Software and Affected Versions: PZ Frontend Manager WordPress plugin versions prior to 1.0.6 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF...

PT-2024-15261 · WordPress · Artplacer Widget

Name of the Vulnerable Software and Affected Versions: ArtPlacer Widget WordPress plugin versions prior to 2.21.2 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...

CVE-2024-41603

Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via the URI /admin/layout...

CVE-2024-41603

Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via the URI /admin/layout...

PT-2024-28347 · Unknown · Phpgurukul Online Shopping Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal Project version 2.0 Description: The PHPGurukul Online Shopping Portal Project contains a vulnerability that allows Cross-Site Request Forgery CSRF to lead to Stored Cross-Site Scripting XSS. An attacker can...

CVE-2024-39090

The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery CSRF to lead to Stored Cross-Site Scripting XSS. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's session, potentiall...

CVE-2024-40119

Nepstech Wifi Router xpon terminal model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery CSRF vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover...

PT-2024-28617 · WordPress · Cooked

Name of the Vulnerable Software and Affected Versions: Cooked versions up to, and including, 1.7.15.4 Description: The Cooked plugin for WordPress is affected by a Cross-Site Request Forgery CSRF issue due to missing or incorrect nonce validation on the AJAX action handler. This could allow an...

CVE-2024-40119

CVE-2024-40119 affects Nepstech Wifi Router xpon (terminal), model NTPL-Xpon1GFEVN v1.0 with Firmware V2.0.1. The vulnerability is a CSRF flaw in the password change function that allows remote attackers to change the admin password without user consent, potentially leading to an account takeover...

CVE-2024-5815

A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating factor is that the attacker would have to be a trusted GitHub Enterprise Server user, and the victim would have to visit...

PT-2024-5677 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to a parameter in the market module of the Netcat CMS system, which is vulnerable to cross-site request forgery. This could allow a remote attacker to execute...

PT-2024-5676 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS filemanager module affected versions not specified Description: The issue is related to a cross-site request forgery vulnerability in the filemanager module of the Netcat CMS system. This could allow a remote attacker to execute...

PT-2024-5670 · Netcat · Netcat Netshop Cms

Name of the Vulnerable Software and Affected Versions: Netcat Netshop CMS affected versions not specified Description: The issue is related to a cross-site request forgery vulnerability in the netshop CMS module of Netcat. This could allow a remote attacker to execute arbitrary JavaScript code in...

CVE-2024-6075

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress SULly plugin < 4.3.1 - Plugin Reset via CSRF vulnerability

Plugin Reset via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin SULly versions 4.3.1...

PT-2024-37368 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...