PT-2025-16616 · Unknown · Ever Accounting

Name of the Vulnerable Software and Affected Versions: Ever Accounting versions n/a through 2.1.5 Description: A Cross-Site Request Forgery CSRF issue affects Ever Accounting, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 2.1.5, updat...

PT-2025-15733 · Unknown · Abozain Albanna Customize Login Page

Name of the Vulnerable Software and Affected Versions: AboZain Albanna Customize Login Page versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-15848 · Brizy Pro · Brizy Pro

Name of the Vulnerable Software and Affected Versions: Brizy Pro versions 2.6.1 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects Brizy Pro, enabling Cross Site Request Forgery. Recommendations: For...

PT-2025-15729 · Unknown · Purab Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Purab Seo Meta Tags versions 1.4 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Purab Seo Meta Tags, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Purab Seo Meta Tags version...

PT-2025-14911 · Unknown · Libro De Reclamaciones Y Quejas

Name of the Vulnerable Software and Affected Versions: Libro de Reclamaciones y Quejas versions 0.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 0.9 and earlier, consider implementing...

PT-2025-14219 · Unknown · Digireturn Simple Fixed Notice

Name of the Vulnerable Software and Affected Versions: digireturn Simple Fixed Notice versions 1.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of atta...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / azcopy / cert-manager / cf-cli / coredns (CVE-2024-51744)

The version of application-gateway-kubernetes-ingress / azcopy / cert-manager / cf-cli / coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-51744 advisory. - golang-jwt is a Go implementation...

Citrix Infrastructure Monitoring- issue with adding new PVS/SF servers for monitoring from Cloud UI

When Admin tries to add/register new PVS or Storefront Servers for monitoring, the eror message appears:Incorrect token. Ensure you copy and paste the token correctly. The token is valid. Network trace shows 500 response code when the request is send to...

CVE-2024-0392

A Cross-Site Request Forgery CSRF vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user,...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the absence of CSRF token validation. An attacker can compromise account settings and data integrity by crafting malicious requests that can trigger state-changing operations on behalf of an...

CVE-2024-0392 Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation

A Cross-Site Request Forgery CSRF vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user,...

CVE-2024-0392 Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation

A Cross-Site Request Forgery CSRF vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operations on behalf of an authenticated user,...

PT-2025-8918

Name of the Vulnerable Software and Affected Versions WSO2 Enterprise Integrator version 6.6.0 Description A Cross-Site Request Forgery CSRF issue exists in the management console due to the absence of CSRF token validation. This allows attackers to craft malicious requests that can trigger...

CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

PT-2025-7769

Name of the Vulnerable Software and Affected Versions: Önceki Yazı Link versions n/a through 1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This vulnerability allows for Cross Site Request Forgery. Recommendations: For Önceki Yazı Link versions n/a throu...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

CVE-2024-12860

The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for...

CVE-2024-12860

The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for...

CVE-2024-12860

CVE-2024-12860 refers to the CarSpot – Dealership WordPress Classified Theme. The vulnerability allows unauthenticated privilege escalation via account takeover because the plugin does not properly validate a token before updating a user’s password. The issue affects CarSpot up to and including v...