CVE-2019-10784

CRITICAL Year: 2019
CVSS v3 Score
9.6
Critical
CVSS v2 Score
9.3
Critical
Weakness Type
CWE-352
View all →

Vulnerability Description

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit a malicious page with a CSRF exploit and execute arbitrary system commands on the server.

Related Vulnerabilities

CVE-2016-6637

CRITICAL
CVSS:9.6(Critical)

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x ...

CWE-3522016

CVE-2020-12076

CRITICAL
CVSS:9.6(Critical)

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.

CWE-3522020

CVE-2020-6167

CRITICAL
CVSS:9.6(Critical)

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote f...

CWE-3522020

CVE-2021-25010

CRITICAL
CVSS:9.6(Critical)

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are...

CWE-3522021

CVE-2023-2746

CRITICAL
CVSS:9.6(Critical)

The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a re...

CWE-3522023

CVE-2023-37277

CRITICAL
CVSS:9.6(Critical)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipar...

CWE-3522023