CWE-352

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "remdex/livehelperchat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-08T20:27:25Z",
    "nvd_published_at": "2021-12-07T11:15:00Z",
    "severity": "LOW"
  },
  "details": "An attacker is able to log out a user if a logged-in user visits the attacker\u0027s website. While this cannot harm a user\u0027s account, it can be a great annoyance and is a valid CSRF.",
  "id": "GHSA-h86j-6h6m-qjqw",
  "modified": "2021-12-09T17:55:01Z",
  "published": "2021-12-10T20:26:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4049"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livehelperchat/livehelperchat/commit/e7fe1aa6a087d4d21b2e8a0dadd2e08f42acbb57"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/livehelperchat/livehelperchat"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/62408fa4-2c16-4fcd-8b34-41fcdccb779e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Cross-Site Request Forgery in remdex/livehelperchat"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-49399"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-20T08:15:35Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms allows Cross Site Request Forgery. This issue affects NEX-Forms: from n/a through 9.1.3.",
  "id": "GHSA-h86p-h6mg-qw33",
  "modified": "2026-04-01T18:35:54Z",
  "published": "2025-08-20T09:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49399"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-plugin-9-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64262"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-13T10:15:51Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in ramon fincken Auto Prune Posts auto-prune-posts allows Cross Site Request Forgery.This issue affects Auto Prune Posts: from n/a through \u003c= 3.0.0.",
  "id": "GHSA-h892-pxc3-qmf2",
  "modified": "2026-01-20T15:31:55Z",
  "published": "2025-11-13T12:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64262"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/auto-prune-posts/vulnerability/wordpress-auto-prune-posts-plugin-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/auto-prune-posts/vulnerability/wordpress-auto-prune-posts-plugin-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2011-5068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-01-29T04:04:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via user_delete.php and other unspecified programs.",
  "id": "GHSA-h89v-3j3f-gx8h",
  "modified": "2022-05-17T01:51:10Z",
  "published": "2022-05-17T01:51:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5068"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71653"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/show/osvdb/77657"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/45437"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/576355"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/50896"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-17386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-10T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.",
  "id": "GHSA-h8gj-39q9-2hmw",
  "modified": "2024-04-04T02:19:44Z",
  "published": "2022-05-24T16:58:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17386"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fanimate-it%2Ftags%2F2.3.6%2Fedsanimate.php\u0026old=2129363\u0026new_path=%2Fanimate-it%2Ftags%2F2.3.5%2Fedsanimate.php"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/animate-it/#developers"
    },
    {
      "type": "WEB",
      "url": "https://wpvulndb.com/vulnerabilities/9900"
    },
    {
      "type": "WEB",
      "url": "https://www.pluginvulnerabilities.com/2019/07/29/vulnerability-details-cross-site-request-forgery-csrf-cross-site-scripting-xss-in-animate-it"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T21:17:34Z",
    "nvd_published_at": "2026-03-19T23:16:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `save_membership` action in `modules/profile/profile_function.php` saves changes to a member\u0027s role membership start and end dates but does not validate the CSRF token. The handler checks `stop_membership` and `remove_former_membership` against the CSRF token but omits `save_membership` from that check. Because membership UUIDs appear in the HTML source visible to authenticated users, an attacker can embed a crafted POST form on any external page and trick a role leader into submitting it, silently altering membership dates for any member of roles the victim leads.\n\n## Details\n\n### CSRF Check Is Absent for save_membership\n\nFile: `D:/bugcrowd/admidio/repo/modules/profile/profile_function.php`, lines 40-42\n\nThe CSRF guard covers only two of the three mutative modes:\n\n```php\nif (in_array($getMode, array(\u0027stop_membership\u0027, \u0027remove_former_membership\u0027))) {\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n}\n```\n\nThe `save_membership` mode is missing from this array. The handler then proceeds to read dates from `$_POST` and update the database without any token verification:\n\n```php\n} elseif ($getMode === \u0027save_membership\u0027) {\n    $postMembershipStart = admFuncVariableIsValid($_POST, \u0027adm_membership_start_date\u0027, \u0027date\u0027, array(\u0027requireValue\u0027 =\u003e true));\n    $postMembershipEnd   = admFuncVariableIsValid($_POST, \u0027adm_membership_end_date\u0027,   \u0027date\u0027, array(\u0027requireValue\u0027 =\u003e true));\n\n    $member = new Membership($gDb);\n    $member-\u003ereadDataByUuid($getMemberUuid);\n    $role = new Role($gDb, (int)$member-\u003egetValue(\u0027mem_rol_id\u0027));\n\n    // check if user has the right to edit this membership\n    if (!$role-\u003eallowedToAssignMembers($gCurrentUser)) {\n        throw new Exception(\u0027SYS_NO_RIGHTS\u0027);\n    }\n    // ... validates dates ...\n    $role-\u003esetMembership($user-\u003egetValue(\u0027usr_id\u0027), $postMembershipStart, $postMembershipEnd, ...);\n    echo \u0027success\u0027;\n}\n```\n\nFile: `D:/bugcrowd/admidio/repo/modules/profile/profile_function.php`, lines 131-169\n\n### The Form Does Generate a CSRF Token (Not Validated)\n\nFile: `D:/bugcrowd/admidio/repo/modules/profile/roles_functions.php`, lines 218-241\n\nThe membership date form is created via `FormPresenter`, which automatically injects an `adm_csrf_token` hidden field into every form. However, the server-side `save_membership` handler never retrieves or validates this token. An attacker\u0027s forged form does not need to include the token at all, since the server does not check it.\n\n### Who Can Be Exploited as the CSRF Victim\n\nFile: `D:/bugcrowd/admidio/repo/src/Roles/Entity/Role.php`, lines 98-121\n\nThe `allowedToAssignMembers()` check grants write access to:\n- Any user who is `isAdministratorRoles()` (role administrators), or\n- Any user who is a leader of the target role when the role has `rol_leader_rights` set to `ROLE_LEADER_MEMBERS_ASSIGN` or `ROLE_LEADER_MEMBERS_ASSIGN_EDIT`\n\nRole leaders are not system administrators. They are regular members who have been designated as group leaders (e.g., a sports team captain or committee chair). This represents a low-privilege attack surface.\n\n### UUIDs Are Discoverable from HTML Source\n\nThe save URL for the membership date form is embedded in the profile page HTML:\n\n```\n/adm_program/modules/profile/profile_function.php?mode=save_membership\u0026user_uuid=\u003cUUID\u003e\u0026member_uuid=\u003cUUID\u003e\n```\n\nAny authenticated member who can view a profile page can extract both UUIDs from the page source.\n\n## PoC\n\nThe attacker hosts the following HTML page and tricks a role leader into visiting it while logged in to Admidio:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003cbody onload=\"document.getElementById(\u0027csrf_form\u0027).submit()\"\u003e\n  \u003cform id=\"csrf_form\"\n        method=\"POST\"\n        action=\"https://TARGET/adm_program/modules/profile/profile_function.php?mode=save_membership\u0026user_uuid=\u003cVICTIM_USER_UUID\u003e\u0026member_uuid=\u003cMEMBERSHIP_UUID\u003e\"\u003e\n    \u003cinput type=\"hidden\" name=\"adm_membership_start_date\" value=\"2000-01-01\"\u003e\n    \u003cinput type=\"hidden\" name=\"adm_membership_end_date\"   value=\"2000-01-02\"\u003e\n  \u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nExpected result: The target member\u0027s role membership dates are overwritten to 2000-01-01 through 2000-01-02, effectively terminating their active membership immediately (end date is in the past).\n\nNote: No `adm_csrf_token` field is required because the server does not validate it for `save_membership`.\n\n## Impact\n\n- **Unauthorized membership date manipulation:** A role leader\u0027s session can be silently exploited to change start and end dates for any member of roles they lead. Setting the end date to a past date immediately terminates the member\u0027s active participation.\n- **Effective access revocation:** Membership in roles controls access to role-restricted features (events visible only to role members, document folders with upload rights, and mailing list memberships). Revoking membership via CSRF removes these access rights.\n- **Covert escalation:** An attacker could also extend a restricted membership period beyond its authorized end date, maintaining access for a user who should have been deactivated.\n- **No administrative approval required:** The impact occurs silently on the victim\u0027s session with no confirmation dialog or notification email.\n\n## Recommended Fix\n\n### Fix 1: Add `save_membership` to the existing CSRF validation check\n\n```php\n// File: modules/profile/profile_function.php, lines 40-42\nif (in_array($getMode, array(\u0027stop_membership\u0027, \u0027remove_former_membership\u0027, \u0027save_membership\u0027))) {\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n}\n```\n\n### Fix 2: Use the form-object validation pattern (consistent with other write endpoints)\n\n```php\n} elseif ($getMode === \u0027save_membership\u0027) {\n    // Validate CSRF via form object (consistent pattern used by DocumentsService, etc.)\n    $membershipForm = $gCurrentSession-\u003egetFormObject($_POST[\u0027adm_csrf_token\u0027]);\n    $formValues = $membershipForm-\u003evalidate($_POST);\n\n    $postMembershipStart = $formValues[\u0027adm_membership_start_date\u0027];\n    $postMembershipEnd   = $formValues[\u0027adm_membership_end_date\u0027];\n    // ... rest of save logic unchanged\n}\n```",
  "id": "GHSA-h8gr-qwr6-m9gx",
  "modified": "2026-03-20T21:15:40Z",
  "published": "2026-03-16T21:17:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-h8gr-qwr6-m9gx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32755"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/releases/tag/v5.0.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio is Missing CSRF Protection on Role Membership Date Changes"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "trestle-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0"
            },
            {
              "fixed": "0.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-29435"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-13T17:01:38Z",
    "nvd_published_at": "2021-04-13T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails\u0027 built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.\n\n### Patches\nThe vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)\n* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)",
  "id": "GHSA-h8hx-2c5r-32cf",
  "modified": "2021-04-13T17:01:38Z",
  "published": "2021-04-13T17:01:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/trestle-auth/CVE-2021-29435.yml"
    },
    {
      "type": "WEB",
      "url": "https://rubygems.org/gems/trestle-auth"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-Site Request Forgery (CSRF) in trestle-auth"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-02T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-h8m4-rhxm-3v55",
  "modified": "2025-03-02T12:33:52Z",
  "published": "2025-03-02T12:33:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1813"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.298081"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.298081"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.504281"
    },
    {
      "type": "WEB",
      "url": "https://www.yuque.com/u123456789-6sobi/cdgcbq/icmicuv9nkkvixb4?singleDoc#%20%E3%80%8AZZ_CSRF%E3%80%8B"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T09:15:48Z",
    "severity": "MODERATE"
  },
  "details": "The Like-it plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the likeit_conf() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-h8mw-3f4v-23qm",
  "modified": "2025-11-18T09:30:51Z",
  "published": "2025-11-18T09:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12404"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/like-it.php#L130"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/like-it.php#L131"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/tpl/config.php#L37"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad1d9f5-c224-4d28-8d73-439b3c5ca24f?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-35615"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-28T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.",
  "id": "GHSA-h8pv-pv44-xcvw",
  "modified": "2022-05-24T17:37:28Z",
  "published": "2022-05-24T17:37:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35615"
    },
    {
      "type": "WEB",
      "url": "https://developer.joomla.org/security-centre/833-20201106-core-csrf-in-com-privacy-emailexport-feature.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}