CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2024-52420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-19T17:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Creative Motion Disable Admin Notices individually allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through 1.3.5.",
  "id": "GHSA-x2f7-hh2h-82c7",
  "modified": "2026-04-01T18:32:34Z",
  "published": "2024-11-19T18:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52420"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/disable-admin-notices/vulnerability/wordpress-disable-admin-notices-individually-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/disable-admin-notices/wordpress-disable-admin-notices-individually-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-20T10:15:03Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2.",
  "id": "GHSA-x2fw-rvp7-jwxc",
  "modified": "2026-04-01T18:32:07Z",
  "published": "2024-10-20T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49335"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/googledrive-folder-list/vulnerability/wordpress-googledrive-folder-list-plugin-2-2-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/googledrive-folder-list/wordpress-googledrive-folder-list-plugin-2-2-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T02:15:51Z",
    "severity": "MODERATE"
  },
  "details": "Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriate request type, this deviation from expected request semantics may allow an attacker to trigger unintended actions on behalf of an authenticated user causing low impact on integrity of the system. This has no impact on confidentiality and availability.",
  "id": "GHSA-x2gq-6c9p-44p8",
  "modified": "2026-01-13T03:32:08Z",
  "published": "2026-01-13T03:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0493"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3655229"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-30705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-27T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin \u003c= 2.35.1.2.3 versions.",
  "id": "GHSA-x2m8-4x5h-2r66",
  "modified": "2023-03-31T03:30:31Z",
  "published": "2023-03-27T15:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30705"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wordpress-ping-optimizer/wordpress-ping-optimizer-plugin-2-35-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-23465"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-15T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.",
  "id": "GHSA-x2p9-gm8g-4xvp",
  "modified": "2023-02-24T18:30:27Z",
  "published": "2023-02-15T21:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23465"
    },
    {
      "type": "WEB",
      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-7352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-04-02T18:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-2945.",
  "id": "GHSA-x2pf-fgmw-jw47",
  "modified": "2022-05-17T04:47:54Z",
  "published": "2022-05-17T04:47:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7352"
    },
    {
      "type": "WEB",
      "url": "https://www.htbridge.com/advisory/HTB23152"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-05/0004.html"
    },
    {
      "type": "WEB",
      "url": "http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/show/osvdb/92906"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/121481/b2evolution-4.1.6-SQL-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:nexus-task-runner"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-29T22:05:30Z",
    "nvd_published_at": "2025-10-29T14:15:58Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
  "id": "GHSA-x2pv-fph3-phfx",
  "modified": "2025-11-05T20:53:16Z",
  "published": "2025-10-29T15:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64141"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40928"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:12:53Z",
    "nvd_published_at": "2026-04-21T23:16:20Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nMultiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller\u0027s session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently:\n\n1. Cast/flip the victim\u0027s like/dislike on any comment (`objects/comments_like.json.php`).\n2. Post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`).\n3. Delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights.\n\nEach endpoint is reachable from a browser via a simple `\u003cimg src=\"\u2026\"\u003e` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource.\n\n## Details\n\nAVideo exposes a helper, `forbidIfIsUntrustedRequest()` (`objects/functionsSecurity.php:138`), that rejects cross-origin requests when the `Referer`/`Origin` does not match `webSiteRootURL`. It is only invoked in one file in the tree \u2014 `objects/userUpdate.json.php:18` \u2014 and is *not* applied to the endpoints below. There is also an `isGlobalTokenValid()` helper (`objects/functions.php:2313`) intended for CSRF-style token checks; none of the affected endpoints call it. `allowOrigin()` only sets CORS response headers and does not prevent cookie-bearing top-level or image requests from reaching the server.\n\n### 1. `objects/comments_like.json.php` \u2014 CSRF \u2192 forced like/dislike\n\n```php\n// objects/comments_like.json.php\n15: if (empty($_POST[\u0027comments_id\u0027]) \u0026\u0026 !empty($_GET[\u0027comments_id\u0027])) {\n16:     $_POST[\u0027comments_id\u0027] = $_GET[\u0027comments_id\u0027];\n17: }\n18:\n19: $like = new CommentsLike($_GET[\u0027like\u0027], $_POST[\u0027comments_id\u0027]);\n20: echo json_encode(CommentsLike::getLikes($_POST[\u0027comments_id\u0027]));\n```\n\nThe endpoint deliberately promotes `$_GET[\u0027comments_id\u0027]` to `$_POST[\u0027comments_id\u0027]` so the call works for either verb. `CommentsLike::__construct` (`objects/comments_like.php:18`) reads `User::getId()`, calls `load()` to fetch any prior vote, then `setLike()` + `save()` \u2014 issuing an `INSERT`/`UPDATE` on `comments_likes` keyed to the session user (`objects/comments_like.php:70-89`). There is no token check and no origin check.\n\n### 2. `objects/commentAddNew.json.php` \u2014 CSRF \u2192 forced comment posting\n\n```php\n// objects/commentAddNew.json.php\n34: if (!User::canComment()) {\n35:     $obj-\u003emsg = __(\"Permission denied\");\n36:     die(json_encode($obj));\n37: }\n...\n117: $objC = new Comment($_REQUEST[\u0027comment\u0027], $_REQUEST[\u0027video\u0027]);\n118: $objC-\u003esetComments_id_pai($_REQUEST[\u0027comments_id\u0027]);\n...\n124: $obj-\u003ecomments_id = $objC-\u003esave();\n```\n\nAll inputs come from `$_REQUEST`, so GET is fully supported. The only gate is `User::canComment()`, which is true for ordinary logged-in users. `isCommentASpam()` (lines 39\u201397) is a per-session rate limiter, not a CSRF defense \u2014 it accounts the victim\u0027s own session bucket, so it does not block a single forged write. The comment is persisted under the victim\u0027s `users_id` via `$objC-\u003esave()`.\n\n### 3. `objects/categoryDeleteAssets.json.php` \u2014 CSRF \u2192 forced deletion of category assets\n\n```php\n// objects/categoryDeleteAssets.json.php\n14: $obj-\u003eid = intval(@$_REQUEST[\u0027id\u0027]);\n15:\n16: if (!Category::canCreateCategory()) {\n17:     $obj-\u003emsg = __(\"Permission denied\");\n18:     die(json_encode($obj));\n19: }\n20:\n21: if (!Category::deleteAssets($obj-\u003eid)) {\n22:     $obj-\u003eerror = false;\n23: ...\n```\n\nState-destroying operation reachable by GET with no CSRF defense. The attacker can enumerate category ids with a loop of `\u003cimg\u003e` tags \u2014 every one fires a credentialed request.\n\n### Root cause (shared)\n\nAll three endpoints follow the same pattern: `objects/*.json.php` handler that (a) reads mutating parameters from `$_REQUEST`/`$_GET`, (b) performs authorization against the victim\u0027s session, and (c) writes to the database \u2014 without calling `forbidIfIsUntrustedRequest()`, without validating a CSRF token, and without any `SameSite` mitigation in the session cookie set by AVideo\u0027s auth layer. Any logged-in victim loading an attacker-controlled HTML resource is sufficient.\n\n## PoC\n\nPreconditions: attacker controls a page the victim loads while logged into the target AVideo instance. Cookies are sent by default on cross-site `\u003cimg\u003e`/top-level GETs.\n\n### Variant A \u2014 comments_like.json.php (force a downvote on comment id 10)\n\nAttacker page:\n```html\n\u003cimg src=\"https://victim.example.com/objects/comments_like.json.php?like=-1\u0026comments_id=10\" style=\"display:none\"\u003e\n```\n\nManual verification:\n```bash\ncurl -b \u0027PHPSESSID=\u003cvictim-session\u003e\u0027 \\\n  \u0027https://victim.example.com/objects/comments_like.json.php?like=-1\u0026comments_id=10\u0027\n# \u2192 {\"comments_id\":10,\"likes\":...,\"dislikes\":...,\"myVote\":-1}\n# Row inserted/updated in `comments_likes` with users_id = victim.\n```\n\n### Variant B \u2014 commentAddNew.json.php (force victim to post a phishing comment on video 123)\n\nAttacker page:\n```html\n\u003cimg src=\"https://victim.example.com/objects/commentAddNew.json.php?comment=Check+out+my+free+giveaway+https%3A%2F%2Fattacker.example%2Fscam\u0026video=123\" style=\"display:none\"\u003e\n```\n\nManual verification:\n```bash\ncurl -b \u0027PHPSESSID=\u003cvictim-session\u003e\u0027 \\\n  \u0027https://victim.example.com/objects/commentAddNew.json.php?comment=phish\u0026video=123\u0027\n# \u2192 {\"error\":false,\"comments_id\":\u003cid\u003e,\"msg\":\"Your comment has been saved!\",...}\n```\n\n### Variant C \u2014 categoryDeleteAssets.json.php (force a category admin to delete assets on category 1)\n\nAttacker page (enumerate several ids):\n```html\n\u003cimg src=\"https://victim.example.com/objects/categoryDeleteAssets.json.php?id=1\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/categoryDeleteAssets.json.php?id=2\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/categoryDeleteAssets.json.php?id=3\"\u003e\n```\n\nManual verification:\n```bash\ncurl -b \u0027PHPSESSID=\u003ccategory-admin-session\u003e\u0027 \\\n  \u0027https://victim.example.com/objects/categoryDeleteAssets.json.php?id=1\u0027\n# \u2192 {\"error\":false,\"msg\":\"\",\"id\":1}\n# Assets for category 1 are removed.\n```\n\n## Impact\n\n- **Integrity of social signals:** Attackers can flip any logged-in user\u0027s likes/dislikes to upvote attacker comments or downvote legitimate comments at scale (driven by whichever users visit the attacker page). Because the endpoint accepts `like=-1|0|1`, arbitrary vote states can be forced.\n- **Identity abuse via forced comments:** An attacker can cause any logged-in user with comment permission to \"post\" attacker-controlled text on any video. This enables impersonation, phishing link injection under a trusted account, harassment of third parties in a victim\u0027s name, and (if the victim is a moderator/admin) endorsement-shaped content in a privileged voice.\n- **Data loss:** Any user with `canCreateCategory()` who visits an attacker page can be made to silently delete assets belonging to arbitrary categories. Since category ids are small integers, a loop of `\u003cimg\u003e` tags can cover the full category space in one page load.\n\nNo special configuration is required; AVideo\u0027s default session cookie lacks a `SameSite=Lax/Strict` protection that would independently blunt the attack, and none of the affected endpoints verifies origin or token.\n\n## Recommended Fix\n\n1. Call the existing `forbidIfIsUntrustedRequest()` helper at the top of every mutating `objects/*.json.php` handler (the same pattern already used in `objects/userUpdate.json.php`):\n\n```php\n// objects/comments_like.json.php (add near line 9)\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/functionsSecurity.php\u0027;\nforbidIfIsUntrustedRequest();\n\n// objects/commentAddNew.json.php (add after configuration.php include)\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/functionsSecurity.php\u0027;\nforbidIfIsUntrustedRequest();\n\n// objects/categoryDeleteAssets.json.php (add after configuration.php include)\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/functionsSecurity.php\u0027;\nforbidIfIsUntrustedRequest();\n```\n\n2. Require `$_SERVER[\u0027REQUEST_METHOD\u0027] === \u0027POST\u0027` (or `DELETE`) for state-changing operations and stop promoting `$_GET[\u0027comments_id\u0027]` \u2192 `$_POST[\u0027comments_id\u0027]` in `comments_like.json.php:15-17`.\n\n3. Validate a per-session CSRF token on all mutating endpoints using the existing `isGlobalTokenValid()` / `getToken()` helpers (`objects/functions.php:2313`), rejecting requests whose `globalToken` is missing or invalid.\n\n4. As defense in depth, set the session cookie with `SameSite=Lax` (or `Strict`) in the AVideo session initialization, so cross-site navigational GETs do not carry the session cookie even if a handler regresses.\n\nApplying (1) alone closes all three reported variants; (2)\u2013(4) harden the surface against variants of the same pattern in other `objects/*.json.php` handlers.",
  "id": "GHSA-x2pw-9c38-cp2j",
  "modified": "2026-04-24T20:32:32Z",
  "published": "2026-04-14T23:12:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40928"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-02T17:15:20Z",
    "severity": "MODERATE"
  },
  "details": "The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the savePricingTable() function. This makes it possible for unauthenticated attackers to create and edit pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-x2qm-79p9-jg87",
  "modified": "2024-05-02T18:30:53Z",
  "published": "2024-05-02T18:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2959"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/svs-pricing-tables/trunk/app/model/svs_pt_model_main.php#L61"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/78af081a-807b-48c8-82cd-f87fbef0fbe6?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:50Z",
    "severity": "HIGH"
  },
  "details": "FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.",
  "id": "GHSA-x2w2-frfv-4f2j",
  "modified": "2025-03-20T12:32:52Z",
  "published": "2025-03-20T12:32:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9847"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flatpressblog/flatpress/commit/a81c968f51f134b5e5f9bbe208aa12f4fbc329df"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/b30ef7b0-74ea-4cac-adc4-1cc8a5cb559e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}