Threats tagged 'ghsa-28g9-rxcj-4j2q'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.9	CVE-2025-71454vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in Medium6.92026-11-04GCVE DatabaseCVE-2025-71454 vtenext versions before 25.02.2 have a vulnerability where the CSRF protection mechanism can be bypassed. The function csrf_check() in include/utils/VteCsrf.php does not validate the __csrf_token for non-POST requests, allowing attackers to trick logged-in users into executing state-changing GET requests. This can lead to unauthorized actions performed with the user's privileges. Report on CVE-2025-71454 Vulnerability CWE-352 #ghsa-28g9-rxcj-4j2q	GCVE Database	2026-11-04

Page 1 of 1