EUVD-2025-211252

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read fro...

CVE-2025-71454

The software vtenext versions prior to 25.02.2 is vulnerable to a CSRF protection bypass caused by HTTP method tampering . The root cause resides in include/utils/VteCsrf.php, where the csrf_check() function fails to validate the __csrf_token for non-POST requests. An attacker can trick a logged-...