25921 matches found
CVE-2025-26689
Direct request 'Forced Browsing' issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
GHSA-GFHV-5RQH-7QX3 ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
Server-side Request Forgery (SSRF)
Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Email Settings. An attacker can manipulate the server into making requests to unintended locations by sending crafted inputs to the affected settings...
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
CVE-2024-29071
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings...
CVE-2025-1762
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-1762
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-1762
CVE-2025-1762 concerns the WordPress plugin Event Tickets with Ticket Scanner prior to version 2.5.4. The root cause is missing CSRF protection when updating settings, enabling a logged-in attacker to cause settings changes via CSRF. Public sources (NVD, Red Hat, CVE lists) confirm the vulnerabil...
CVE-2025-28093
ShopXO CVE-2025-28093 affects ShopXO v6.4.0 with a Server-Side Request Forgery (SSRF) in the Email Settings feature. Exploitation arises from insufficient validation of user-supplied URLs, enabling the server to initiate arbitrary outbound requests to internal or external resources. The CVSSv3.1 ...
WordPress plugin Event Tickets with Ticket Scanner 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
PT-2025-13589 · Shopxo · Shopxo
Name of the Vulnerable Software and Affected Versions: ShopXO version 6.4.0 Description: The issue is related to Server-Side Request Forgery SSRF in the Email Settings. This means an attacker could potentially forge requests from the server, leading to unauthorized access to internal systems or...
CVE-2025-28093
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF in Email Settings...
ShopXO 安全漏洞
ShopXO is an open source enterprise-grade open source e-commerce system from ShopXO Inc. A security vulnerability exists in ShopXO version v6.4.0, which originates from server-side request forgery in email settings...
CVE-2025-22670 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.7.2 - CSRF to Settings Change vulnerability
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through = 1.7.2...
WordPress Float menu plugin <= 6.1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Khang Duong in WordPress Plugin Float menu versions = 6.1.2...