PT-2025-13118

Name of the Vulnerable Software and Affected Versions Custom Field For WP Job Manager versions 1.4 and earlier Description A Cross-Site Request Forgery CSRF issue affects the Custom Field For WP Job Manager, allowing unauthorized requests. This is a type of attack where an attacker tricks a user...

CVE-2025-30538

CVE-2025-30538 describes a CSRF vulnerability in the WordPress plugin Simple Optimizer (affecting up to version 1.2.7). The Initial Document notes a Cross-Site Request Forgery issue with Simple Optimizer and lists affected scope “from n/a through 1.2.7.” The Connected Documents add a Wordfence vu...

PT-2025-12587

Name of the Vulnerable Software and Affected Versions Image Captcha versions n/a through 1.2 Description A Cross-Site Request Forgery CSRF issue affects the Image Captcha software, allowing unauthorized requests to be made on behalf of a user. This can lead to various security problems, as an...

CVE-2024-7819

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the...

CVE-2024-49822

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2024-7819 CORS Misconfiguration in danswer-ai/danswer

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the...

CVE-2024-7819

A CVE-2024-7819 entry concerns danswer-ai/danswer v1.4.1. The vulnerability is a CORS misconfiguration caused by improper validation of the origin header, enabling malicious web pages to issue unauthorized requests to the application's API and potentially disclose sensitive data (e.g., chat conte...

Vanna 代码问题漏洞

Vanna is a personalized AI SQL agent from Vanna Inc. Vanna suffers from a code issue vulnerability that stems from a server-side request forgery when using DuckDB as a database, which allows an attacker to make unauthorized requests by submitting specially crafted SQL queries...

ComfyUI 跨站请求伪造漏洞

ComfyUI is one of the most powerful and modular diffusion model GUIs and backends from comfyanonymous individual developers. A cross-site request forgery vulnerability exists in ComfyUI v0.2.2 and prior versions, which stems from insufficient CSRF protection and could lead to unauthorized API...

CVE-2024-49822

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2024-49822 IBM QRadar Advisor server-side request forgery

IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

PT-2025-11603 · Ibm · Ibm Qradar Advisor

Name of the Vulnerable Software and Affected Versions: IBM QRadar Advisor versions 1.0.0 through 2.6.5 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a...

PT-2025-9016 · Elestio · Elestio Memos

Name of the Vulnerable Software and Affected Versions: elestio memos version 0.23.0 Description: The issue is related to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. This vulnerability allows attackers to...

PT-2025-7868

Name of the Vulnerable Software and Affected Versions ClickWhale versions through 2.4.3 Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations For versions through 2.4.3, update to a version that contains a fix for this issue...

PT-2025-7741

Name of the Vulnerable Software and Affected Versions JPG, PNG Compression and Optimization versions 1.7.35 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations For versions 1.7.35 and earlier, update to a version th...

PT-2025-7742

Name of the Vulnerable Software and Affected Versions RAYS Grid versions 1.3.1 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations For versions 1.3.1 and earlier, update to a version that includes a fix for this...

PT-2025-7755

Name of the Vulnerable Software and Affected Versions Just Variables versions 1.2.3 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests to be made on behalf of the user. Recommendations For versions 1.2.3 and earlier, update to a...

PT-2025-7749

Name of the Vulnerable Software and Affected Versions WP-PostRatings Cheater versions 1.5 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations For WP-PostRatings Cheater versions 1.5 and earlier, update to a version...

PT-2025-7724

Name of the Vulnerable Software and Affected Versions Add Linked Images To Gallery versions 1.4 and earlier Description A Cross-Site Request Forgery CSRF issue affects the Add Linked Images To Gallery, allowing unauthorized requests. Recommendations For versions 1.4 and earlier, update to a versi...

CVE-2024-37359

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. CWE-918 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 an...