CVE-2025-67989 WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through = 4.1.3...

CVE-2025-66844

In grav 1.7.49.5, a SSRF Server-Side Request Forgery vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered...

CVE-2025-68083: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through = 1.0...

PT-2025-51766

Name of the Vulnerable Software and Affected Versions Ctera Portal versions 8.1.x 8.1.1417.24 Description A Server-Side Request Forgery SSRF issue exists in Ctera Portal. This allows remote attackers to make arbitrary HTTP requests by providing a crafted HTML file containing an iframe. The...

PT-2025-51774

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.2 Parse Server versions prior to 9.1.1-alpha.1 Description Parse Server, a backend deployable on Node.js infrastructure, contains a flaw in its Instagram authentication adapter. Prior to versions 8.6.2 and...

WordPress plugin WordPress plugin Kerge 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plug...

CVE-2025-65593

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery CSRF via the Schedule Tasks functionality...

PT-2025-51461

Cross-Site Request Forgery CSRF vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through = 1.1.32...

CVE-2025-13231: Concurrent Execution using Shared Resource with Improper Synchronization

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-52196

Server-Side Request Forgery SSRF vulnerability in Ctera Portal 8.1.x 8.1.1417.24 allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe...

WordPress plugin Quick Interest Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-51442

Name of the Vulnerable Software and Affected Versions LMPixels Kerge versions through 4.1.3 Description The software contains a Server-Side Request Forgery SSRF flaw. This allows for Server Side Request Forgery. Recommendations Update to a version newer than 4.1.3...

CVE-2025-64237: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quick Interest Slider: from n/a through = 3.1.5...

WordPress plugin Meks Quick Plugin Disabler 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security...

CVE-2025-68082: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through = 1.1.32...

CVE-2025-59009: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through = 3.2.5...

CVE-2025-64240: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through = 2.3.4...

PT-2025-51387

Name of the Vulnerable Software and Affected Versions Yoav Farhi RTL Tester versions through 1.2 Description A Cross-Site Request Forgery CSRF issue exists in Yoav Farhi RTL Tester. This allows attackers to potentially perform actions on behalf of an authenticated user without their knowledge. Th...

CVE-2025-66407 Weblate has Server-Side Request Forgery vulnerability

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is...

CVE-2025-66407

Weblate before v5.15 is vulnerable to SSRF and local file enumeration when creating a Component with Mercurial as VCS. The repository URL field is not validated/sanitized, allowing arbitrary protocols/hosts, including localhost and file://, which can expose internal endpoints and filesystem layou...