CVE-2023-48283

CVE-2023-48283 affects the WordPress plugin Simple Testimonials Showcase (PressTigers) up to version 1.1.5. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be exploited by unauthenticated attackers to trigger actions on behalf of site admins. Public sources concur this is a CSRF...

CVE-2023-48323

CVE-2023-48323: CSRF in Awesome Support for WordPress (plugin: Awesome Support – WordPress HelpDesk & Support Plugin) affects versions 6.1.4 (6.1.5). The CVE’s CVSS from NVD is 8.8 in one metric, but NVD’s entry here (and related Red Hat/EU ENISA summaries) align with a lower overall assessment; ...

CVE-2023-49076

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5...

CVE-2023-49076 Pimcore missing token/header to prevent CSRF

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5...

PT-2023-30533 · WordPress · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login versions n/a through 5.2.2.6 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. The estimated...

Dreamer CMS 跨站请求伪造漏洞

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which originates from a failure to adequately validate whether a request is from a trusted user in the component...

PT-2023-30754 · Unknown · Seraphinite Post .Docx Source

Name of the Vulnerable Software and Affected Versions: Seraphinite Post .DOCX Source versions n/a through 2.16.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

CVE-2023-49655

A cross-site request forgery CSRF vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system...

PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with...

PT-2023-8642 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: S/Notify versions prior to 4.0.2 for Jira Description: An issue was discovered that allows the configuration settings of S/Notify to be modified via a CSRF attack while an administrative user is logged on. This could be initiated by the...

WordPress Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Plugin <= 3.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49148 Patch priority Low CVSS severity Low 5.4 Developer Claim...

CVE-2023-47824

CVE-2023-47824: Cross-Site Request Forgery in WordPress plugin Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator (

CVE-2023-47791

CVE-2023-47791 IDs a CSRF flaw in the Leadster WordPress plugin (versions

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WattIsIt PayGreen – Ancienne version plugin = 4.10.2 versions...

CVE-2023-2440

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'adminpage', 'userproverifyuser' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to...

CVE-2023-26542

Cross-Site Request Forgery CSRF vulnerability in Exeebit phpinfo WP plugin = 4.0 versions...

CVE-2023-27458

Cross-Site Request Forgery CSRF vulnerability in wpstream WpStream plugin = 4.4.10 versions...

CVE-2023-26532

Cross-Site Request Forgery CSRF vulnerability in AccessPress Themes Social Auto Poster plugin = 2.1.4 versions...

CVE-2023-27444 WordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Pierre Lannoy / PerfOps One DecaLog plugin = 3.7.0 versions...

PT-2023-21130 · WordPress · Leyka

Name of the Vulnerable Software and Affected Versions: Leyka plugin versions = 3.29.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application that the user i...