10424 matches found
Cross Site Request Forgery (CSRF)
shopware/shopware is vulnerable to cross-site request forgery. The vulnerability exists in CSRFTokenValidator.php due to the lack of validation in csrf token which allows an attacker to make changes to the system as a legitimate user...
WordPress plugin Rara One Click Demo Import 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. version 1.2.9 and earlier of the Rara One Click Demo Imports plugin are vulnerable to cross-site request...
Tenda AX12 Cross-Site Request Forgery Vulnerability (CNVD-2022-63550)
Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda, China.Tenda AX12 V22.03.01.21CN firmware version is vulnerable to cross-site request forgery, which is caused by the sub422168 function of /goform/WifiExtraSet that does not sufficiently validate whether the request is from a...
CVE-2022-27375
Tenda AX12 V22.03.01.21CN was discovered to contain a Cross-Site Request Forgery CSRF via the function sub422168 at /goform/WifiExtraSet...
CVE-2022-1092
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog...
CVE-2022-0398
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an...
CVE-2022-0363
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...
Cross site request forgery (csrf)
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...
PT-2022-13127 · WordPress · Mycred
Name of the Vulnerable Software and Affected Versions: myCred WordPress plugin versions prior to 2.4.3.1 Description: The issue concerns the lack of authorization and CSRF checks in the mycred-tools-import-export AJAX action. This allows any authenticated users, such as subscribers, to call the...
PT-2022-13317 · WordPress · Thirstyaffiliates
Name of the Vulnerable Software and Affected Versions: ThirstyAffiliates WordPress plugin versions prior to 3.10.5 Description: The issue lacks authorization checks in the ta insert external image action, allowing a low-privilege user to add an image from an external URL to an affiliate link...
CVE-2022-28108
Selenium Server Grid before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain...
WordPress Videos sync PDF plugin <= 1.7.4 - Stored Cross-Site Scripting via Cross-Site Request Forgery (CSRF) vulnerability
Stored Cross-Site Scripting via Cross-Site Request Forgery CSRF vulnerability discovered by UnD3sc0n0c1d0 in WordPress Videos sync PDF plugin versions = 1.7.4. Solution Deactivate and delete. This plugin has been closed as of April 19, 2022 and is not available for download. This closure is...
CVE-2022-0707
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack...
Webmin Cross-site Request Forgery Vulnerability (CNVD-2022-61346)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site request forgery vulnerability exists in Webmin version 1.973, which stems from the lack of token validation for cross-site request forgery in the file management...
CVE-2022-29048
A cross-site request forgery CSRF vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL...
CVE-2021-36914 WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...
PT-2022-10605 · Calderawp · Calderawp License Manager
Name of the Vulnerable Software and Affected Versions: CalderaWP License Manager versions prior to 1.2.12 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that can lead to Reflected Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...
CVE-2022-27847
Cross-Site Request Forgery CSRF vulnerability in Yooslider Yoo Slider = 2.0.0 on WordPress allows attackers to import templates...