CVE-2021-4390

The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the managewppostsbeqesavepost function. This makes it possible for unauthenticated attackers to quick edit...

CVE-2021-32674

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

Cross site request forgery (csrf)

TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the...

Ltd. CmsEasy station building system file contains vulnerabilities

Through the enterprise website system Alias CmsEasy is the domestic free WeChat + cell phone end + micro site + cell phone text message + online sales + multi-language website combination of enterprise marketing management platform. Siping City, Jiuzhou Yi Tong Technology Co., Ltd CmsEasy...