FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save

CVE-2024-22601HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save

CVE-2024-22603HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link

CVE-2024-2262MEDIUMCVSS 4.7EG 4.7

2024-04-01

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs

CVE-2024-22643MEDIUMCVSS 6.5EG 6.5

2024-01-30

A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets.

CVE-2024-22699HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.

CVE-2024-22715HIGHCVSS 8.8EG 8.8

2024-01-17

Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php.

CVE-2024-22721MEDIUMCVSS 6.3EG 6.3

2024-04-11

Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.

CVE-2024-2277MEDIUMCVSS 4.3EG 4.3

2024-03-08

A vulnerability was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Setting/change_password_save of the component P…

CVE-2024-22817HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte

CVE-2024-22818HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save

CVE-2024-22819HIGHCVSS 8.8EG 8.8

2024-01-18

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.

CVE-2024-22859HIGHCVSS 8.8EG 8.8

2024-02-01

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 4…

CVE-2024-2288HIGHCVSS 8.3EG 8.3

2024-06-06

A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows…

CVE-2024-22939HIGHCVSS 8.8EG 8.8

2024-02-29

Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component.

CVE-2024-23094HIGHCVSS 8.8EG 8.8

2024-02-22

Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php

CVE-2024-2316MEDIUMCVSS 4.3EG 4.3

2024-03-08

A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This vulnerability affects unknown code of the file /billing/bill/edit/ of the component Update Bill Page. The manipulation leads t…

CVE-2024-2322MEDIUMCVSS 6.8EG 6.8

2024-04-03

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe …

CVE-2024-2326MEDIUMCVSS 4.3EG 4.3

2024-03-23

The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce v…

CVE-2024-23319LOWCVSS 3.5EG 3.5

2024-02-09

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

CVE-2024-23510MEDIUMCVSS 4.3EG 4.3

2024-03-27

Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8.

CVE-2024-23515MEDIUMCVSS 5.4EG 5.4

2024-03-27

Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.

CVE-2024-23519MEDIUMCVSS 4.3EG 4.3

2024-02-29

Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7.

CVE-2024-2354MEDIUMCVSS 4.3EG 4.3

2024-03-10

A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible t…

CVE-2024-23554MEDIUMCVSS 5.7EG 5.7

2024-05-18

Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).

CVE-2024-23597MEDIUMCVSS 4.3EG 4.3

2024-05-01

Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. If a logged-in user of TVRock accesses a specially crafted page, unintended operations may be performed. Note that the developer was unreachable, therefore, users sho…

CVE-2024-2368MEDIUMCVSS 4.3EG 4.3

2024-06-05

The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible fo…

CVE-2024-23734MEDIUMCVSS 5.2EG 5.2

2024-04-10

Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted li…

CVE-2024-23736HIGHCVSS 8.8EG 8.8

2024-07-01

Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.

CVE-2024-23737MEDIUMCVSS 5.4EG 5.4

2024-07-01

Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.

CVE-2024-2376HIGHCVSS 8.8EG 8.8

2024-07-03

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVE-2024-23785MEDIUMCVSS 6.5EG 6.5

2024-02-14

Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings.

CVE-2024-23831HIGHCVSS 7.5EG 7.5

2024-02-02

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setu…

CVE-2024-23902MEDIUMCVSS 4.3EG 4.3

2024-01-24

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2024-23910HIGHCVSS 8.8EG 8.8

2024-02-28

Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the af…

CVE-2024-2395HIGHCVSS 7.3EG 7.3

2024-03-12

The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possi…

CVE-2024-2405MEDIUMCVSS 4.5EG 4.5

2024-05-02

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.

CVE-2024-2416MEDIUMCVSS 6.5EG 6.5

2024-03-13

Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are curre…

CVE-2024-2429MEDIUMCVSS 4.3EG 4.3

2024-04-26

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2024-24336HIGHCVSS 8.1EG 8.1

2024-03-19

A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out …

CVE-2024-24468HIGHCVSS 8.8EG 8.8

2024-02-05

Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php.

CVE-2024-24469HIGHCVSS 8.8EG 8.8

2024-02-05

Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php.

CVE-2024-24470HIGHCVSS 8.8EG 8.8

2024-02-02

Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php component.

CVE-2024-2449HIGHCVSS 7.5EG 7.5

2024-03-22

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrat…

CVE-2024-24524HIGHCVSS 8.8EG 8.8

2024-02-02

Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component.

CVE-2024-24593CRITICALCVSS 9.6EG 9.6

2024-02-06

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted ht…

CVE-2024-24701MEDIUMCVSS 4.3EG 4.3

2024-02-29

Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/a through 2.1.20.

CVE-2024-24702MEDIUMCVSS 4.3EG 4.3

2024-02-28

Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5.

CVE-2024-24705MEDIUMCVSS 5.4EG 5.4

2024-02-28

Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6.

CVE-2024-24706MEDIUMCVSS 5.4EG 5.4

2024-02-07

Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8.

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 110 of 175

Map vulnerabilities like CWE-352 to your infrastructure