PT-2025-19726 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNEXT versions 14.74.3 through 14.82.1 Description: A Cross-Site Request Forgery CSRF vulnerability was discovered, allowing an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

PT-2025-19760 · Hcl · Hcl Bigfix Compliance

Name of the Vulnerable Software and Affected Versions: HCL BigFix Compliance affected versions not specified Description: The issue is related to an improper or missing SameSite attribute, which can lead to Cross-Site Request Forgery CSRF attacks. A malicious site could trick a user's browser int...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

CVE-2025-47244 affects Inedo ProGet (versions 2024.22 and earlier). The vulnerability stems from the C# reflection layer, which can be abused by remote attackers to reach restricted functionality, potentially causing a denial of service (e.g., looping RestartWeb) or exposing sensitive information...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...

CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...

BIT-MOODLE-2024-43434 Moodle: csrf risk in feedback non-respondents report

The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability...

Debian: Security Advisory (DLA-4151-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-1305

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsbloggerinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-32354

In Zimbra Collaboration ZCS 9.0 through 10.1, a Cross-Site Request Forgery CSRF vulnerability exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying...

Debian dla-4151 : golang-github-gorilla-csrf-dev - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4151 advisory. - -------------------------------------------------------------------------- Debian LTS Advisory DLA-4151-1 [email protected] https://www.debian.org/lts/security...

DLA-4151-1 golang-github-gorilla-csrf - security update

Bulletin has no description...

Exploit for Cross-Site Request Forgery (CSRF) in Nosurf_Project Nosurf

CVE-2025-46721: CSRF...

Cross-Site Request Forgery (CSRF)

moodle/moodle is vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing validation checks in the tour duplication feature, allowing unauthorized users to duplicate existing tours without logging in...

CVE-2025-32354

In Zimbra Collaboration ZCS 9.0 through 10.1, a Cross-Site Request Forgery CSRF vulnerability exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying...

Cross-Site Request Forgery (CSRF)

moodle/moodle is vulnerable to Cross-site Request Forgery CSRF. The vulnerability is due to the absence of a CSRF token in the analysis request action of the Brickfield tool, allows attackers to forge unauthorized requests on behalf of authenticated users...

CVE-2025-32354

In Zimbra Collaboration ZCS 9.0 through 10.1, a Cross-Site Request Forgery CSRF vulnerability exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying...