GHSA-3JW2-5HJG-HC2C Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute sandboxed Groovy code. As of publication of this advisory, the...

GHSA-MJ6V-4WR4-GJ57 Jenkins Start Windocks Containers Plugin is missing a permission check

Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site reque...

GHSA-JWM4-955W-4HJ3 Jenkins Themis Plugin is missing a permission check

Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery CSRF...

Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery

Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site reque...

Jenkins Themis Plugin is missing a permission check

Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery CSRF...

Jenkins Start Windocks Containers Plugin is missing a permission check

Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site reque...

Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery

Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this endpoint does not require POST...

CVE-2025-64133

A cross-site request forgery CSRF vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code...

CVE-2025-64290

CVE-2025-64290 is a CSRF vulnerability in the WordPress plugin Premmerce Product Search for WooCommerce (premmerce-search), affecting versions up to 2.2.4. The issue is described as Cross-Site Request Forgery that could allow an attacker to perform actions on behalf of an authenticated user. The ...

CVE-2025-57931 WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ays Pro Popup box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through 5.5.4...

PT-2025-44300

Name of the Vulnerable Software and Affected Versions Blu-Castle BCUM221E version 1.0.0P220507 Description A Cross-Site Request Forgery CSRF issue exists in the administrative web GUI. This can be exploited through various methods, including a crafted URL, loading an image, or using an...

PT-2025-44318

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description A systemic lack of Cross-Site Request Forgery CSRF token implementation exists. This complete absence of CSRF protections in BLU-IC controllers allows for trivial...

PT-2025-44285

Name of the Vulnerable Software and Affected Versions Jenkins Themis Plugin versions 1.4.1 and earlier Description A cross-site request forgery CSRF issue exists in Jenkins Themis Plugin. This allows attackers to potentially connect to an HTTP server specified by the attacker. A CSRF attack...

CVE-2025-62258

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter...

GHSA-GH4W-8QGQ-8W9R Liferay Portal Vulnerable to CSRF in Headless APIs

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter...

Liferay Portal Vulnerable to CSRF in Headless APIs

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter...

CVE-2025-62258

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the endpoint parameter...

CVE-2025-62258

CSRF in Headless API of Liferay Portal and Liferay DXP affects multiple releases: Liferay Portal 7.4.0–7.4.3.107 and Liferay DXP 2023.Q3.1–2023.Q3.4, plus 7.4 GA up to update 92 and 7.3 GA up to update 35, and older unsupported versions. The vulnerability allows remote attackers to execute any He...

CVE-2025-62958

CVE-2025-62958 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “Simple Content Templates for Blog Posts & Pages” (simple-post-template) by Clifton Griffin. The issue affects versions from n/a up to and including 2.2.61. Public sources in the connected documents...

CVE-2025-62957

CVE-2025-62957 affects NikanWP WooCommerce Reporting wc-reports-lite (WordPress plugin) up to version 1.0.0. The issue is described as a Cross-Site Request Forgery (CSRF) vulnerability that can lead to Stored XSS. Public sources (NVD, Red Hat, CVE lists) assign a high severity (CVSS 3.1 base scor...