CVE-2022-25810

The CVE-2022-25810 entry applies to the Transposh WordPress Translation plugin (versions up to 1.0.8.1). The vulnerability is due to missing authorization checks on functions exposed under the Utilities page (/wp-admin/admin.php?page=tp_utils), allowing a lowest-privileged user to execute sensiti...

WellCMS 跨站请求伪造漏洞

WellCMS is an open source, billion-load, mobile-leaning, lightweight, super-responsive, high-load CMS that is the best choice for large data volumes and high concurrent access websites. Users - Create User - Add New User does not sufficiently verify that the request is from a trusted user. An...

IBM Security Verify Information Queue Cross-Site Request Forgery Vulnerability (CNVD-2022-54907)

IBM Security Verify Information Queue is an integration product from IBM USA. It utilizes Kafka technology and a publish/subscribe model to integrate data between IBM Security products. A cross-site request forgery vulnerability exists in IBM Security Verify Information Queue version 10.0.2, whic...

Synology Calendar Cross-Site Request Forgery Vulnerability

Synology Calendar, a file protection application running on Synology NAS devices from Synology, Taiwan, China, is vulnerable to cross-site request spoofing in versions prior to Synology Calendar 2.3.4-0631, which stems from a webapi component that does not adequately validate that the request is...

IBM Security Verify Information Queue Cross-Site Request Forgery Vulnerability (CNVD-2022-55633)

IBM Security Verify Information Queue is an integration product from IBM of America, Inc. IBM Security Verify Information Queue version 10.0.2 contains a cross-site request forgery vulnerability that originates when a WEB application does not adequately verify that a request is from a trusted use...

Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

The plugin exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and...

Jorani Cross-Site Request Forgery Vulnerability

Jorani is a leave management system. Designed to provide small organizations with a simple workflow for leave and overtime requests. A cross-site request forgery vulnerability exists in Jorani version 1.0, which stems from the /application/controllers/Users.php page not adequately verifying that ...

FUEL CMS Cross-Site Request Forgery Vulnerability (CNVD-2022-59047)

FUEL CMS is a content management system CMS based on the Codelgniter framework. A cross-site request forgery vulnerability exists in FUEL CMS version 1.5.0, which can be exploited by an attacker to forge a malicious request and trick a victim into clicking on it to perform a sensitive operation...

Selenium Server 跨站请求伪造漏洞

Selenium Grid is an intelligent proxy server for the Selenium community. It can easily run tests in parallel on multiple machines.A cross-site request spoofing vulnerability exists in versions prior to Selenium Server 4, which can be exploited by attackers to spoof malicious requests to trick...

WordPress Church Admin plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site request forgery vulnerability exists in the...

Moodle Cross-Site Request Forgery Vulnerability (CNVD-2022-08151)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site request forgery vulnerability exists in Moodle 3.11 through 3.11.4, 3.10 through 3.10.8, and 3.9 through 3.9.11, which ste...

mysiteforme Cross-Site Request Forgery Vulnerability

Mysiteforme is a permission management system. A cross-site request forgery vulnerability exists in mysiteforme, which stems from a lack of validation for cross-site request forgery in the backend blog administration. An attacker could use a forged malicious request to trick a victim into clickin...

WordPress Single Post Exporter plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . Single Post Exporter plugin is a WordPress open source application plugin. WordPress Single Post Exporter plugin in version 1.1 and earlier contains a cross-site request forgery vulnerability, whic...

Incorrect Accrual Of sumNative and sumUSD In Producing Consultation Results

Handle leastwood Vulnerability details Vulnerability details Impact The TwapOracle.consult function iterates over all token pairs which belong to either VADER or USDV and then calculates the price of the respective asset by using both UniswapV2 and Chainlink price data. This helps to further...

Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack

Description Login CSRF via /register/confirm/token endpoint. Proof of Concept 1: Register account with the same username as our victim, an email confirmation will take place 2: Retrieve token from email. 3: Send a link http://BOOKSTACKAPPURL/register/confirm/token to user. 4: When the user clicks...

WordPress plugin Wechat Reward 跨站脚本漏洞

WordPress is a set of blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress Wechat Reward plugin in versions 1.7 and...

Cross-Site Request Forgery in sqlite-web

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

PYSEC-2021-332

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

CVE-2021-23404

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

UPchieve: Widespread CSRF on authenticated POST endpoints

Summary: Cross-Site Request Forgery CSRF is possible on most, if not all, authenticated POST endpoints. While CORS is configured such that the Access-Control-Allow-Origin header is set to Access-Control-Allow-Origin: hackers.upchieve.org, CORS does not prevent CSRF - it only prevents the attacker...