174 matches found
CVE-2025-23922
CVE-2025-23922 - WordPress iSpring Embedder CSRF를 통한 임의 파일 업로드 📌 CVE 상세 CVE ID: CVE-2025-23922 게시일: 2025-01-16 영향받는 플러그인: WordPress iSpring Embedder 플러그인 영향받는 버전: CSRF File Upload Exploit body font-family: Arial, sans-serif; background-color: f4f4f4; padding: 20px; .container background: fff;...
CVE-2026-17998
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...
CVE-2018-25435 ZeusCart 4.0 Deactivate Customer Accounts CSRF
ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages...
PT-2026-43574
The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts...
CVE-2018-25321
TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via...
Cross-site Request Forgery (CSRF)
Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the groupsroles.php process. An attacker can cause unauthorized deletion, activation, or...
CVE-2020-37118
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interaction. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking...
CVE-2020-37054 Navigate CMS 2.8.7 - Cross-Site Request Forgery
Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without...
CVE-2025-64387 CLICKJACKING
The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login...
EUVD-2018-15732
Malware in sbrugna...
EUVD-2018-15728
Malware in sbrugna...
EUVD-2018-8143
Malware in sbrugna...
EUVD-2021-2022
Malware in sbrugna...
EUVD-2024-46269
Malicious code in bioql PyPI...
EUVD-2025-27672
Malicious code in bioql PyPI...
EUVD-2023-44792
Malicious code in bioql PyPI...
EUVD-2025-16663
Malicious code in bioql PyPI...
EUVD-2024-54111
Malicious code in bioql PyPI...
CVE-2025-6247
The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update campaigns and...
Booking.com phish uses fake CAPTCHAs to trick hotel staff into downloading malware
A new phishing campaign that uses the fake CAPTCHA websites we reported about recently is targeting hotel staff in a likely attempt to access customer data, according to research from ThreatDown. Here's how it works: Cybercriminals send a fake Booking.com email to a hotel’s email address, asking...