PT-2025-51826

Mattermost versions 11.0.x = 11.0.4, 10.12.x = 10.12.2, 10.11.x = 10.11.6 and Mattermost Calls versions =1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious...

CVE-2025-68082 WordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through = 1.1.32...

CVE-2025-64240 WordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through = 2.3.4...

PT-2025-51385

Name of the Vulnerable Software and Affected Versions Graham Quick Interest Slider versions through 3.1.5 Description A Cross-Site Request Forgery CSRF issue exists in Graham Quick Interest Slider. This allows attackers to perform actions on behalf of unsuspecting users. Recommendations Update...

CVE-2025-14462 Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update

The Lucky Draw Contests plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation in misc-settings.php. This makes it possible for unauthenticated attackers to update plugin settings via a forge...

WordPress Image Slider by Ays- Responsive Slider and Carousel plugin <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Slider Deletion vulnerability discovered by ChamlaVic in WordPress Plugin Image Slider by Ays versions = 2.7.0...

EUVD-2025-202989

The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform variou...

CVE-2025-14391

The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted...

CVE-2025-13366

CVE-2025-13366 (Rabbit Hole) is a CSRF vulnerability in the Rabbit Hole WordPress plugin (versions up to and including 1.1). The root cause is missing or incorrect nonce validation on the plugin’s reset functionality, with the reset operation performed via GET, enabling exploitation by tricking a...

CVE-2025-14062 Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter

The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the marquee deletion function. This makes it possible for unauthenticated attacke...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion vulnerability

Cross-Site Request Forgery to Location Deletion vulnerability discovered by thinnawarth mathuros in WordPress Plugin Events Manager versions = 7.2.2.2...

WordPress Secure Copy Content Protection and Content Locking plugin <= 4.9.2 - Cross-Site Request Forgery to Data Export vulnerability

Cross-Site Request Forgery to Data Export vulnerability discovered by Deadbee - NA in WordPress Plugin Secure Copy Content Protection and Content Locking versions = 4.9.2...

PT-2025-50841

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'sup pt handle deletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

PT-2025-50925

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays sccp results export file' AJAX action. This makes it possible for unauthenticate...

PT-2025-50858

The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update plugin settings including th...

FreeBSD : jenkins -- multiple vulnerabilities (2956aba3-1fcb-4c39-9cea-d88a46a3bf93)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2956aba3-1fcb-4c39-9cea-d88a46a3bf93 advisory. Jenkins Security Advisory: Denial of service vulnerability in HTTP-based CLI Missing permissio...

📄 FlatPress 1.3 Shell Upload

FlatPress version 1.3 remote shell upload proof of concept exploit that leverages a cross site request forgery vulnerability. ============================================================================================================================================= | Title : FlatPress 1.3 shell...

CVE-2025-34430

1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery CSRF vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that...

CVE-2025-14390

The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version = 5.0.4. This is due to missing or incorrect nonce validation on the videomerchantaddvideofile function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote...

TableProgressTracking 跨站请求伪造漏洞

TableProgressTracking is an open source MediaWiki extension from Telepedia. A cross-site request forgery vulnerability exists in TableProgressTracking 1.2.0 and earlier versions, which stems from a lack of CSRF token validation in the REST API, and could lead to a cross-site request forgery attac...