CVE-2025-1320

The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request...

WordPress teachPress plugin <= 9.0.9 - Cross-Site Request Forgery to Import Delete vulnerability

Cross-Site Request Forgery to Import Delete vulnerability discovered by Krzysztof Zając in WordPress Plugin teachPress versions = 9.0.9...

PT-2023-26996 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: The issue allows files to be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path in the back office. There are no...