51552 matches found
PT-2025-2984
Name of the Vulnerable Software and Affected Versions CodeChecker versions through 6.24.4 Description Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged-in user and use the web API with the same permissions, including adding, removing, or editin...
CVE-2024-54792
A Cross-Site Request Forgery CSRF vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users...
WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability
CSRF to Settings Update & Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Estatebud – Properties & Listings versions = 5.5.0...
CVE-2025-23044
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...
CVE-2025-23044
PwnDoc (pwndoc) is affected by a CSRF vulnerability due to missing protection and SameSite cookies, enabling cross-site requests on behalf of authenticated users. The issue is associated with the project commit 14acb704891245bf1703ce6296d62112e85aa995, which patches the vulnerability. Public desc...
CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...
CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...
Cross-Site Request Forgery (CSRF)
typo3/cms-form is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper handling of state-changing actions in downstream components, which incorrectly accept submissions via HTTP GET requests instead of enforcing the correct HTTP method. Misconfigured settings, such ...
PT-2025-4789 · Pwndoc · Pwndoc
Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to the version that includes commit 14acb704891245bf1703ce6296d62112e85aa995 Description: PwnDoc is a penetration test report generator that lacks CSRF protection, allowing attackers to send requests on a logged-in user'...
CVE-2025-23898
Cross-Site Request Forgery CSRF vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...
CVE-2025-23884
Cross-Site Request Forgery CSRF vulnerability in Chris Roberts Annie annie allows Cross Site Request Forgery.This issue affects Annie: from n/a through = 2.1.1...
CVE-2025-23832
Cross-Site Request Forgery CSRF vulnerability in Matt Gibbs Admin Cleanup admin-cleanup allows Stored XSS.This issue affects Admin Cleanup: from n/a through = 1.0.2...
CVE-2025-23815
Cross-Site Request Forgery CSRF vulnerability in linickx root Cookie allows Cross Site Request Forgery. This issue affects root Cookie: from n/a through 1.6...
CVE-2025-23818
Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...
CVE-2025-23800
Cross-Site Request Forgery CSRF vulnerability in nova706 OrangeBox orangebox allows Cross Site Request Forgery.This issue affects OrangeBox: from n/a through = 3.0.0...
CVE-2025-23801
Cross-Site Request Forgery CSRF vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through = 1.4.3...
CVE-2025-23692
Cross-Site Request Forgery CSRF vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through = 1.3...
CVE-2025-23677
Cross-Site Request Forgery CSRF vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through = 0.2.4...
CVE-2025-23675
Cross-Site Request Forgery CSRF vulnerability in Sana Ullah Import Users to MailChimp import-users-to-mailchimp allows Stored XSS.This issue affects Import Users to MailChimp: from n/a through = 1.0...