CVE-2023-7051

PHPGurukul Online Notes Sharing System manage-notes.php cross-site request forgery

A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/manage-notes.php of the component Notes Handler. The manipulation of the argument delid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248738 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Notes Sharing System

CVE-2023-7038

automad User Creation cross-site request forgery

A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automad

Products

Automad

CVE-2023-6904

Jahastech NxFilter config,admin.jsp cross-site request forgery

A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5. This vulnerability affects unknown code of the file /config,admin.jsp. The manipulation of the argument admin_name leads to cross-site request forgery. The attack can be initiated remotely. VDB-248266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nxfilter

Products

Nxfilter

CVE-2023-6766

PHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgery

A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/course.php of the component Delete Course Handler. The manipulation of the argument delid leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247896.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Teacher Subject Allocation Management System

CVE-2023-6671

Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS

A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openjournalsystems

Products

Open Journal Systems

CVE-2023-6653

PHPGurukul Teacher Subject Allocation Management System Create a new Subject subject.php cross-site request forgery

A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/subject.php of the component Create a new Subject. The manipulation of the argument cid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247346 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Teacher Subject Allocation Management System

CVE-2023-6633

Site Notes <= 2.0.0 - Admin Note Deletion via CSRF

The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sidenotesproject

Products

Side Notes

CVE-2023-6501

Splashscreen <= 0.20 - Settings Update via CSRF

The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cochinoman

Products

Splashscreen

CVE-2023-6252

Path traversal vulnerability in Chameleon Power products

Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files located on the server and gain access to sensitive information such as configuration files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hyphensolutions

Products

Chameleon Power

CVE-2023-6251

CSRF in delete_user_message

Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Checkmk

Products

Checkmk

CVE-2023-6022

Cross-Site Request Forgery (CSRF) in prefecthq/prefect

Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Prefect

Products

Prefect

CVE-2023-5990

Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Funnelforms

Products

Funnelforms Free

CVE-2023-5979

eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Implecode

Products

Ecommerce Product Catalog

CVE-2023-5886

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Soflyy

Products

Export Any Wordpress Data To Xml\/csv Wp All Export

CVE-2023-5885

Franklin Electric Fueling Systems Colibri Path Traversal

The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Franklinfueling

Products

Colibri Colibri Firmware

CVE-2023-5884

Word Balloon < 4.20.3 - Avatar Removal via CSRF

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Back2nature

Products

Word Balloon

CVE-2023-5727

Mozilla: Download Protections were bypassed by .msix, .msixbundle, .appx, and .appxbundle files on Windows

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Mozilla

Products

Windows Firefox Firefox Esr and 1 more

CVE-2023-5726

Mozilla: Full screen notification obscured by file open dialog on macOS

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Mozilla

Products

Macos Firefox Firefox Esr and 1 more

CVE-2023-5690

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Modoboa

Products

Modoboa

CVE-2023-5687

Cross-Site Request Forgery (CSRF) in mosparo/mosparo

Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mosparo

Products

Mosparo