Cross site request forgery (csrf)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...

CVE-2023-45905

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/add...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via the component /admin/variable/delet...

PT-2023-29761 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component /admin/variable/delete. This allows for unauthorized actions to be performed on the application. Recommendations: F...

CVE-2023-45905: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/add...

CVE-2023-45907

Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) in the /admin/variable/delete component. The vulnerability is recorded as CVE-2023-45907 with CVSS v3.1 base score 8.8 (HIGH); attack vector is NETWORK, no privileges required, user interaction required, and impact to confidentiality...

CVE-2023-45904: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /variable/update...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via the component /admin/variable/add...

CVE-2023-45907

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...

PT-2023-29759 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the /admin/variable/add API endpoint. This allows an attacker to perform unauthorized actions on the system. Recommendations: For...

PT-2023-29758 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component "/variable/update". This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via component/variable/update...

CVE-2023-45907

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...

CVE-2023-45904

Dreamer CMS v4.1.3 is affected by a Cross‑Site Request Forgery (CSRF) vulnerability in the /variable/update component. The issue enables unauthorized actions to be performed on behalf of an authenticated user. Exploitation details are not provided beyond the component path in the connected source...

CVE-2023-45905

Dreamer CMS v4.1.3 is affected by a Cross-Site Request Forgery (CSRF) in the /admin/variable/add endpoint. The CVE-2023-45905 details indicate high impact with CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Root cause appears to be CSRF in the variable management feature. No official patch/versio...

CVE-2023-45907: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/variable/delete...

Cross site scripting

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...

CVE-2023-4290 WP Matterport Shortcode < 2.1.7 - Reflected XSS

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...

CVE-2023-38312

A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...

CVE-2023-38312

A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client with remote control access to a game server to read arbitrary files from the underlying server via the motdfile console variable...