CVE-2024-36550

idccms V1.35 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/vpsCompanydeal.php?mudi=add&nohrefStr=close...

Gutenberg Blocks and Page Layouts – Attire Blocks < 1.9.3 - Missing Authorization

Description The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disablefeassets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated...

CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks Codes:...

PT-2024-25629 · Unknown +2 · Admin Preset Tool +2

Name of the Vulnerable Software and Affected Versions: Admin preset tool affected versions not specified Description: The issue is related to a CSRF risk due to the absence of a necessary token in actions within the admin preset tool. Recommendations: At the moment, there is no information about ...

CVE-2024-3945

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage function. This makes it possible for unauthenticated attackers to add new todo items via a forged...

CVE-2024-5185

CVE-2024-5185 concerns the EmbedAI application, where a CSRF weakness resulting from the absence of secure session management and weak CORS policies enables data poisoning. An attacker can lure a user to a malicious page that triggers the CSRF flaw, causing the user to upload and integrate incorr...

CVE-2024-5185 Data Poisoning in EmbedAI

The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure...

WordPress KKProgressbar2 Free plugin <= 1.1.4.2 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin KKProgressbar2 Free versions = 1.1.4.2...

PT-2024-31571 · WordPress · Business Card Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Business Card WordPress plugin versions prior to 1.0.1 Description: The issue concerns a lack of CSRF checks in certain areas, allowing attackers to potentially manipulate logged-in users into performing unintended actions, such as deleting...

PT-2024-31553

Name of the Vulnerable Software and Affected Versions Business Card WordPress plugin versions 1.0.0 and earlier Description The issue concerns a lack of CSRF checks in certain areas, allowing attackers to potentially make logged-in users perform unwanted actions, such as editing card categories v...

IRZ Mobile Routers Cross-Site Request Forgery (CVE-2022-27226)

A CSRF issue in /api/crontab on iRZ Mobile Routers through 20.6.1 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor...

WordPress Similarity plugin <= 3.0 - CSRF Leading to Plugin Settings Reset vulnerability

CSRF Leading to Plugin Settings Reset vulnerability discovered by Bob Matyas in WordPress Plugin Similarity versions = 3.0...

Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter

GridField does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. Amongst other default CMS interfaces, GridField is used for management of groups, users and permissions in the CMS...

GHSA-W8FQ-XGVH-CXC2 Silverstripe Forum Module CSRF Vulnerability

A number of form actions in the Forum module are directly accessible. A malicious user e.g. spammer can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures. Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting i...

UBUNTU-CVE-2023-7045

A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server KAS...

PT-2024-4184 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.11 through 16.10.5 GitLab CE/EE versions 16.11 through 16.11.2 GitLab CE/EE versions 17.0 through 17.0.0 Description: A CSRF vulnerability exists within GitLab CE/EE. By leveraging this vulnerability, an attacker coul...

DLink DIR < 2.17.b02 (SAP10018)

The version of DLink DIR installed on the remote host is prior to 2.17.b02. It is, therefore, affected by a vulnerability as referenced in the SAP10018 advisory. - Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR-600 router rev. Bx with firmware before 2.17b02 allow remote...

CVE-2024-35551

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoWebdeal.php?mudi=add...

CVE-2024-35557

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/vpsApideal.php?mudi=rev&nohrefStr=close...

CVE-2024-35555

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/shareswitch.php?mudi=switch&dataType=newsWeb&fieldName=state&fieldName2=state&tabName=infoWeb&dataID=40...