4038 matches found
CVE-2025-14988
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system...
CVE-2025-14988
ibaPDA is affected (PT-2026-5016) with version 8.12.0 showing a permission flaw that grants unrestricted filesystem access without authentication, enabling unauthorized actions on the file system and impacting confidentiality, integrity, and availability. No fix version is disclosed in the provid...
EUVD-2025-206383
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system...
PT-2026-5016
Name of the Vulnerable Software and Affected Versions ibaPDA version 8.12.0 Description A security issue exists in ibaPDA that could allow unauthorized actions on the file system. This may impact the confidentiality, integrity, or availability of the system. The issue is a permission flaw that...
CVE-2025-71177
LavaLite CMS ≤ 10.1.0 is reported to have a stored XSS vulnerability in package creation and package search. Authenticated users can inject HTML/JavaScript into the Package Name or Description fields, which is stored and later rendered without proper output encoding in search results, enabling po...
CVE-2026-24530 WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through = 2.2...
CVE-2026-24521
CVE-2026-24521: Cross-Site Request Forgery in WordPress Kama Thumbnail plugin (kama-thumbnail) affecting versions up to and including 3.5.1. The issue is a CSRF vulnerability; no exploitation details are provided in the sources. Remediation per PT-Security is to update Kama Thumbnail to a version...
CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage...
CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage...
CVE-2026-22462
CVE-2026-22462 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “Add Polylang support for Customizer” (component: add-polylang-support-for-customizer) affecting versions from n/a through
CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage...
CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage...
CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage...
PT-2026-4200
Name of the Vulnerable Software and Affected Versions PHPgurukul Online Course Registration version 3.1 Description The application lacks Cross-Site Request Forgery CSRF protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators ...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of object names in the GetArtifactFile function. An attacker can execute arbitrary JavaScript in another user's browser by crafting malicious workflows that produce an HTML artifact enabling...
CVE-2025-36410
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
CVE-2025-36411 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2025-36410 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security...
IBM ApplinX 跨站请求伪造漏洞
IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. IBM ApplinX suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying that a request is from a...