10419 matches found
CVE-2024-3993
The CVE-2024-3993 entry concerns the AZAN Plugin for WordPress (versions
CVE-2024-3971 Similarity <= 3.0 - Plugin Reset via CSRF
The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...
CVE-2024-3965 Pray For Me <= 1.0.4 - Settings Update via CSRF
The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
PT-2024-34698 · WordPress · Inquiry Cart Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Inquiry cart WordPress plugin versions 3.4.2 and earlier Description: The issue concerns the lack of CSRF checks in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins ad...
WordPress plugin WP Prayer II security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress plugin WP Prayer II security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2024-27929 · Alcasar · Alcasar
Name of the Vulnerable Software and Affected Versions: ALCASAR versions prior to 3.6.1 Description: The issue allows for CSRF and remote code execution in the activity.php file. Recommendations: For versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue...
CVE-2024-35657
Cross-Site Request Forgery CSRF vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6...
CVE-2024-5003
The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-5003
CVE-2024-5003 affects WP Stacker WordPress plugin
CVE-2024-2288
CVE-2024-2288 – CSRF in Lollms WebUI profile picture upload affects parisneo/lollms-webui up to version 7.3.0. The vulnerability enables changing a user’s profile picture without consent and can lead to denial of service by filesystem flooding, with potential stored XSS in the victim’s browser se...
CVE-2024-1879
A Cross-Site Request Forgery CSRF vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a us...
WordPress Analytify plugin <=5.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea in WordPress Plugin Analytify versions = 5.2.3...
CVE-2024-36668
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component admin/typedeal.php?mudi=del...
CVE-2024-36669
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component admin/typedeal.php?mudi=add...
CVE-2024-36667
CVE-2024-36667 affects idccms v1.35 and is a Cross-Site Request Forgery (CSRF) vulnerability in the admin endpoint /admin/idcProType_deal.php?mudi=add&nohrefStr=close. The issue enables unauthorized actions to be performed in the context of a logged-in user (impacting confidentiality, integrity a...
CVE-2024-4088
The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disablefeassets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with...
CVE-2024-4088 Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization
The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disablefeassets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with...