CVE-2024-5428

MEDIUM Year: 2024
CVSS v3 Score
4.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

A vulnerability classified as problematic was found in SourceCodester Simple Online Bidding System 1.0. Affected by this vulnerability is the function save_product of the file /admin/index.php?page=manage_product of the component HTTP POST Request Handler. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-266383.

Related Vulnerabilities

CVE-2005-1947

MEDIUM
CVSS:4.3(Medium)

Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) deli...

CWE-3522005

CVE-2014-10382

MEDIUM
CVSS:4.3(Medium)

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

CWE-3522014

CVE-2014-3655

MEDIUM
CVSS:4.3(Medium)

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CWE-3522014

CVE-2015-10001

MEDIUM
CVSS:4.3(Medium)

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege us...

CWE-3522015

CVE-2015-10130

MEDIUM
CVSS:4.3(Medium)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail...

CWE-3522015

CVE-2015-9418

MEDIUM
CVSS:4.3(Medium)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CWE-3522015