CVE-2024-35558

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=rev&nohrefStr=close...

CVE-2024-35552

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoMovedeal.php?mudi=del&dataType=logo&dataTypeCN...

PT-2024-26542 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component /admin/vpsSys deal.php with the mudi parameter set to infoSet. This allows for unauthorized requests to be made on behalf of the user...

PT-2024-26541 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/share switch.php. The affected endpoint includes parameters such as mudi, dataType, fieldName, fieldName2, tabName, and dataID...

GHSA-6WQP-7G94-F69J sensiolabs/connect has a Cross-Site Request Forgery Vulnerability

Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery CSRF vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow...

CVE-2024-36076

CVE-2024-36076 affects SysReptor, with vulnerable versions 2024.28–2024.30. The issue is Cross-Site WebSocket Hijacking, allowing an attacker to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain within the same browser sess...

CVE-2024-34809

CVE-2024-34809 is a CSRF vulnerability in EmpowerWP (Extend Themes EmpowerWP) affecting EmpowerWP versions up to 1.0.21. The related Red Hat and Wordfence entries confirm Cross-Site Request Forgery enabling notice dismissal. Patch status in the vulnerability record indicates EmpowerWP

Fuji Xerox / Fujifilm Printers CSRF Vulnerability (CVE-2024-22475)

Multiple Fuji Xerox / Fujifilm printers are prone to a cross-site request forgery CSRF vulnerability in the Web Based Management. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2024-26987 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions prior to 1.3 Description: The issue concerns a lack of CSRF check when deleting a subscriber, which could allow attackers to make logged-in admins perform such an action via a CSRF attack...

PT-2024-26996

Name of the Vulnerable Software and Affected Versions Newsletter Popup WordPress plugin versions prior to 1.2 Description The issue concerns a lack of CSRF check when deleting a list, which could allow attackers to perform actions via a CSRF attack, making logged-in admins delete lists without...

WordPress Base64 Encoder/Decoder plugin <= 0.9.2 - Settings Reset via CSRF vulnerability

Settings Reset via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Base64 Encoder/Decoder versions = 0.9.2...

CVE-2024-3824

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2024-3406 WP Prayer <= 2.0.9 - Email Settings Update via CSRF

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-35108

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/homeProdeal.php?mudi=del&dataType=&dataTypeCN...

WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin reCAPTCHA Jetpack versions = 0.2.2...

WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin reCAPTCHA Jetpack versions = 0.2.2...

WordPress plugin WP Prayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-26321 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/homePro deal.php" with parameters mudi and nohrefStr. This allows for unauthorized requests to be made. Recommendations: For idccms...

PT-2024-25680 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...

PT-2024-26953 · WordPress · Hl Twitter Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: HL Twitter WordPress plugin versions through 2014.1.18 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For HL...