CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

Design/Logic Flaw

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

CVE-2019-18782

Summary: CVE-2019-18782 affects SuiteCRM 7.10.x (before 7.10.21) and 7.11.x (before 7.11.9). The root cause is a misimplementation of the ".htaccess protection mechanism" in these releases. Impact / exploitation: The documents do not provide detailed exploit vectors or concrete consequences beyon...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

CVE-2019-18782

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

SuiteCRM .htaccess Protection Mechanism Incorrectly Implemented Vulnerability

SuiteCRM is a free open source customer relationship management application. SuiteCRM is vulnerable to an incorrect implementation of the .htaccess protection mechanism. No detailed vulnerability details are provided at this time...

CVE-2019-18782: Undefined Security Weakness

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...

PT-2020-9981

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.10.x prior to 7.10.21 SuiteCRM versions 7.11.x prior to 7.11.9 Description: The issue is related to the incorrect implementation of the .htaccess protection mechanism. Recommendations: For SuiteCRM versions 7.10.x prior to...

WordPress BestWebSoft Htaccess Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. htaccess is an access control plugin used in it. WordPress BestWebSoft Htaccess cross-site request forgery vulnerability, an attacker...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Cross site request forgery (csrf)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The CVE concerns WordPress plugin BestWebSoft Htaccess (

PT-2020-20254

Name of the Vulnerable Software and Affected Versions BestWebSoft Htaccess plugin versions prior to 1.8.2 Description The issue allows for Cross-Site Request Forgery CSRF attacks due to incorrect validation of the htccss nonce name flag, which is supposed to pass a nonce to WordPress for anti-CSR...

CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Htaccess by BestWebSoft < 1.8.2 - CSRF to edit .htaccess

The Htaccess by BestWebSoft WordPress plugin was affected by a CSRF to edit .htaccess security vulnerability. PoC...

Htaccess by BestWebSoft < 1.8.2 - CSRF to edit .htaccess

The Htaccess by BestWebSoft WordPress plugin was affected by a CSRF to edit .htaccess security vulnerability...

WordPress Htaccess by BestWebSoft plugin <= 1.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by V1n1v131r4 in WordPress Htaccess by BestWebSoft plugin versions = 1.8.1. Solution Update the WordPress Htaccess by BestWebSoft plugin to the latest available version at least 1.8.2...