PT-2026-43462

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier Description A cross-site request forgery CSRF issue exists in the 2FA toggle functionality. The endpoint "plugin/LoginControl/set.json.php" accepts POST requests with the parameters type=set2FA and value=false ...

Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37625)

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of a cross-site request forgery vulnerability , the vulnerability stems from /admin/submitpage.php does not adequately verify whether the request is from a trusted user , an attacker can use this...

GO-2024-2821 Denial of Service from untrusted requests in github.com/stacklok/minder

HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service...

CVE-2024-34084

CVE-2024-34084 concerns Minder’s HandleGithubWebhook. Multiple connected records confirm a DoS condition caused by untrusted HTTP requests, where the code path reads the entire request body into memory before validation (notably in readerFromRequest/handle_githubwebhooks.go), enabling memory exha...

Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests

Minder's HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests t...

flatCore Cross-Site Request Forgery Vulnerability (CNVD-2019-23756)

flatCore is a lightweight content management system CMS based on PHP and SQLite. A cross-site request forgery vulnerability exists in flatCore versions prior to 1.5. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An...

HYBBS Cross-Site Request Forgery Vulnerability

HYBBS is a lightweight community forum program. A cross-site request forgery vulnerability exists in the /?admin/user.html page in HYBBS version 2.2, which originates from a WEB application that does not adequately validate whether a request is from a trusted user. An attacker could exploit this...