10419 matches found
CVE-2024-39158
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/userSysdeal.php?mudi=infoSet...
CVE-2024-39158
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/userSysdeal.php?mudi=infoSet...
CVE-2024-39153
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infodeal.php?mudi=del&dataType=news&dataTypeCN...
CVE-2024-39156
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/keyWorddeal.php?mudi=add...
PT-2024-28368 · Idccms · Idccms
Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF that affects the /admin/keyWord deal.php component when the mudi parameter is set to add. This allows for unauthorized requests to be made on behalf of...
CVE-2024-39154
CVE-2024-39154 affects idccms v1.35 and is a Cross-Site Request Forgery (CSRF) via the endpoint /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. The NVD entry notes a CVSSv3.1 base score of 8.8 (HIGH): Network attack vector, low attack complexity, no privileges required, but user intera...
CVE-2024-39156
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/keyWorddeal.php?mudi=add...
idcCMS Security Breach
Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idcCMS v1.35, which originates from the component...
PT-2024-37250 · Imartinez · Privategpt
Name of the Vulnerable Software and Affected Versions: imartinez/privategpt version 0.5.0 Description: A Cross-Site Request Forgery CSRF issue allows an attacker to delete all uploaded files on the server, leading to data loss and service disruption for the application's users. Recommendations: F...
PT-2024-32662 · WordPress · Muslim Prayer Time Bd
Name of the Vulnerable Software and Affected Versions: Muslim Prayer Time BD WordPress plugin versions prior to 2.5 Description: The issue concerns the lack of a CSRF check when resetting settings, which could allow attackers to make a logged-in admin reset them via a CSRF attack. Recommendations...
WordPress Plugin Muslim Prayer Time BD Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2024-4499
A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...
CVE-2021-45785
Summary of CVE-2021-45785 (TruDesk) : TruDesk Help Desk/Ticketing Solution v1.1.11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to restart the server, causing a DoS. The attacker must lure a privileged user to visit a page containing a GET request to th...
WordPress WP Logs Book plugin <= 1.0.1 - Multiple CSRF vulnerability
Multiple CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WP Logs Book versions = 1.0.1...
PT-2024-30682 · WordPress · Cb
Name of the Vulnerable Software and Affected Versions: CB legacy WordPress plugin versions 0.9.4.18 and earlier Description: The issue concerns a lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting codes,...
WordPress plugin WP Logs Book security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2024-1407 Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possibl...
WordPress plugin Paid Memberships Pro security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-28013 · Xenforo · Xenforo
Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For versions prior to 2.2.16, update to version...