CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

Uber: Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymously

Steps to execute the issue/defect 1:Logged into account on domain https://riders.uber.com with one of the accounts account type-Driver 2:Now go to Manage your email subscription settings and note the link mentioned below -View the subscription setting i.e. subscription setting Uber Global Updates...