CVE-2025-27189

MEDIUM Year: 2025
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.

Related Vulnerabilities

CVE-2005-1947

MEDIUM
CVSS:4.3(Medium)

Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) deli...

CWE-3522005

CVE-2014-10382

MEDIUM
CVSS:4.3(Medium)

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

CWE-3522014

CVE-2014-3655

MEDIUM
CVSS:4.3(Medium)

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CWE-3522014

CVE-2015-10001

MEDIUM
CVSS:4.3(Medium)

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege us...

CWE-3522015

CVE-2015-10130

MEDIUM
CVSS:4.3(Medium)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail...

CWE-3522015

CVE-2015-9418

MEDIUM
CVSS:4.3(Medium)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CWE-3522015