51201 matches found
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 3.8.0...
CVE-2025-46341 Privilege escalation via SSRF when using HTTP auth
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed functionality an...
CVE-2025-46341 Privilege escalation via SSRF when using HTTP auth
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed functionality an...
CVE-2025-4580
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4580
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4580
CVE-2025-4580 affects the WordPress File Provider plugin (versions
PT-2025-23761 · WordPress · Filterprovider
Name of the Vulnerable Software and Affected Versions: File Provider versions 1.2.3 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via ...
PT-2025-23556 · Cimatti · Contact Forms By Cimatti
Name of the Vulnerable Software and Affected Versions: Contact Forms by Cimatti versions 1.9.8 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's behalf. This can be achieved by tricking the...
CVE-2025-48483
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML...
BIT-MOODLE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...
BIT-MOODLE-2024-34001 moodle: CSRF risk in admin preset tool management of presets
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk...
WordPress plugin Simple Page Access Restriction 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2025-26211
Gibbon before 29.0.00 allows CSRF...
PT-2025-22955 · Gibbon · Gibbon
Name of the Vulnerable Software and Affected Versions: Gibbon versions prior to 29.0.00 Description: The issue allows for CSRF attacks. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...
Exploit for Cross-Site Request Forgery (CSRF) in Tychesoftwares Order_Delivery_Date_Pro_For_Woocommerce
This is a PoC exploit for CVE-2025-2907, an unauthenticated arbi...
CVE-2025-46458
Cross-Site Request Forgery CSRF vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through = 1.0.3.0...
CVE-2025-46458 WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerability
Cross-Site Request Forgery CSRF vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through = 1.0.3.0...