Total
6247 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-7568 | 1 Pixeljar | 1 Favicon Generator | 2024-09-27 | 9.6 Critical |
| The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. | ||||
| CVE-2023-2919 | 1 Themeum | 1 Tutor Lms | 2024-09-26 | 4.3 Medium |
| The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-7816 | 2 Adeelraza, Gixaw Chat | 2 Gixaw Chat, Gixaw Chat | 2024-09-26 | 6.1 Medium |
| The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | ||||
| CVE-2024-7423 | 1 Xwp | 1 Stream | 2024-09-26 | 8.8 High |
| The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2023-41938 | 1 Jenkins | 1 Ivy | 2024-09-26 | 6.5 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. | ||||
| CVE-2023-41942 | 1 Jenkins | 1 Aws Codecommit Trigger | 2024-09-26 | 4.3 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue. | ||||
| CVE-2023-41946 | 1 Jenkins | 1 Frugal Testing | 2024-09-26 | 3.5 Low |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username. | ||||
| CVE-2023-40953 | 1 Idreamsoft | 1 Icms | 2024-09-26 | 8.8 High |
| icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF). | ||||
| CVE-2024-8795 | 2 Ba-booking, Booking Algorithms | 2 Ba Book Everything, Ba Book Everything | 2024-09-26 | 8.8 High |
| The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account. | ||||
| CVE-2023-4869 | 1 Contact Manager App Project | 1 Contact Manager App | 2024-09-26 | 4.3 Medium |
| A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-4868 | 1 Contact Manager App Project | 1 Contact Manager App | 2024-09-26 | 4.3 Medium |
| A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability. | ||||
| CVE-2024-3163 | 2 Easy Property Listings, Realestateconnected | 2 Easy Property Listings, Easy Property Listings | 2024-09-26 | 4.3 Medium |
| The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack | ||||
| CVE-2023-37973 | 1 Replace Word Project | 1 Replace Word | 2024-09-26 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions. | ||||
| CVE-2023-37892 | 1 Pluginpress | 1 Shortcode Imdb | 2024-09-26 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions. | ||||
| CVE-2024-7386 | 2024-09-26 | 4.3 Medium | ||
| The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link. | ||||
| CVE-2024-46485 | 1 Dingfanzu | 1 Cms | 2024-09-26 | 6.3 Medium |
| dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate | ||||
| CVE-2024-46600 | 1 Dingfangzu | 1 Dingfangzu | 2024-09-26 | 4.7 Medium |
| dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31 | ||||
| CVE-2023-39285 | 1 Mitel | 1 Mivoice Connect | 2024-09-25 | 4.3 Medium |
| A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings. | ||||
| CVE-2023-39286 | 1 Mitel | 1 Connect Mobility Router | 2024-09-25 | 4.3 Medium |
| A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings. | ||||
| CVE-2023-40868 | 1 Moosocial | 1 Moosocial | 2024-09-25 | 8.8 High |
| Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. | ||||