CVE-2026-81920

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

PT-2026-92391

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.exclude words but did not validate the anti-CSRF token that the reset modal emitted, and...

CVE-2026-18030

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

PT-2026-69368

Name of the Vulnerable Software and Affected Versions BricksForge WordPress plugin versions prior to 3.1.8.8 Description An issue exists where the plugin fails to verify the identity of the requester during a password change submitted via a form action. This allows unauthenticated attackers to se...

CVE-2026-58338

A flaw was found in Moodle. The user profile page reset action did not properly implement a token to prevent Cross-Site Request Forgery CSRF. A remote attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user, potentially leading to unintended...

CVE-2011-10033

The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...

CVE-2011-10033

The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...

CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE

The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...

CVE-2011-10033

The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...

CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE

The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...

CVE-2025-11433

A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing a manipulation of the argument ID results in cross site scripting. It i...

PT-2025-41225

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A security flaw exists in itsourcecode Leave Management System 1.0. The issue impacts the redirect function within the /module/employee/controller.php?action=reset file, specifically...

CVE-2023-34869

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /index.php?controller=pjAdmin=pjActionForgot...

SUSE CVE-2025-23162

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST0x941c register that driver uses to reset a GT. Attempt to trigger a reset using debugfs: $ cat...

DEBIAN-CVE-2022-49830

In the Linux kernel, the following vulnerability has been resolved: drm/drv: Fix potential memory leak in drmdevinit drmdevinit will add drmdevinitrelease as a callback. When drmmaddaction failed, the release function won't be added. As the result, the ref cnt added by deviceget in drmdevinit won...

DEBIAN-CVE-2025-23162

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST0x941c register that driver uses to reset a GT. Attempt to trigger a reset using debugfs: $ cat...

CVE-2024-5030

The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version v9.6. An attacker can exploit this vulnerability by sending a specially crafted cross-site request forgery form to trick a us...

CVE-2022-25810

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable th...

PT-2022-17535 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions 1.0.8 and earlier Description: The issue allows access to sensitive actions, such as tp reset, under the Utilities tab, accessible via the /wp-admin/admin.php?page=tp utils endpoint. This...