51193 matches found
CVE-2025-51541
Shopware 6 stores user input in /recovery/install/database-configuration/ via the c_database_schema field without proper sanitization, enabling stored XSS. The issue can be triggered through a CSRF-enabled POST; lack of CSRF protections allows an unauthenticated attacker to craft a page that stor...
PT-2025-31974 · Shopware · Shopware 6
Name of the Vulnerable Software and Affected Versions: Shopware 6 affected versions not specified Description: A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface. The c database schema field does not properly sanitize user-supplied input before renderi...
CVE-2025-51541
A stored cross-site scripting XSS vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The cdatabaseschema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious...
CVE-2025-5988
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda. Mitigation Use HTTPS on the platform ingress if possible. Since this is a problem in edge-terminated...
CVE-2025-5988
A CVE (CVE-2025-5988) affects Ansible Automation Platform’s aap-gateway, where CSRF origin checking is not performed on requests from the gateway to external components (controller, hub, eda). The issue is documented in Red Hat’s advisory RHSA-2025:12772 and Red Hat notes that automation-gateway ...
CVE-2025-5988 Aap-gateway: csrf origin checking is disabled
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda...
CVE-2025-5988 Aap-gateway: csrf origin checking is disabled
A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda...
CVE-2025-54782 @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...
CVE-2025-50847
Cross Site Request Forgery CSRF vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request...
CVE-2025-54529
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...
CVE-2025-54528
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...
CVE-2025-54536
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint...
WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Connector for Gravity Forms and Google Sheets versions = 1.2.4...
WordPress oik plugin <= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin oik versions = 4.15.2...
Security Bulletin: IBM Storage Ceph is vulnerable to CSRF in Grafana (CVE-2023-45857)
Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2023-45857 Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: An issue discovered in Axios 1.5.1 inadvertently reveals the confidential...
Security Bulletin: IBM Storage Ceph is vulnerable to CSRF in Werkzeug (CVE-2024-34069)
Summary Werkzeug is used by IBM Storage Ceph for the Web Server Interface. CVE-2024-34069 This bulletin identifies the steps to take to address the vulnerability in IBM Storage Ceph. Vulnerability Details CVEID:CVE-2024-34069 DESCRIPTION: Werkzeug is a comprehensive WSGI web application library...
Exploit for CVE-2025-54962
🔥 CVE-2025-54962 — Insecure File Upload in OpenPLC Runtime Web...
CISA Adds PaperCut NG/MF CSRF Vulnerability to KEV Catalog Amid Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a high-severity security vulnerability impacting PaperCutNG/MF print management software to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The vulnerability, tracke...
