deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-37089
Published: 2025-06-02
Description: A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37090
Published: 2025-06-02
Description: A server-side request forgery vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37091
Published: 2025-06-02
Description: A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37092
Published: 2025-06-02
Description: A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37093
Published: 2025-06-02
Description: An authentication bypass vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37094
Published: 2025-06-02
Description: A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-5447
Published: 2025-06-02
Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argument apselect_%d/newap_text_%d leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_10/10.md; https://vuldb.com/?ctiid.310786; https://vuldb.com/?id.310786
CVE: CVE-2024-48877
Published: 2025-06-02
Description: A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-680, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128; https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2128
CVE: CVE-2024-52035
Published: 2025-06-02
Description: An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2131; https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2131
CVE: CVE-2024-54028
Published: 2025-06-02
Description: An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-191
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2132; https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2132
CVE: CVE-2025-20001
Published: 2025-06-02
Description: An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2157; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2157
CVE: CVE-2025-37095
Published: 2025-06-02
Description: A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-37096
Published: 2025-06-02
Description: A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US
CVE: CVE-2025-44172
Published: 2025-06-02
Description: Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/hcxj/Tenda-Vul/blob/main/setSmartPowerManagement.md
CVE: CVE-2024-40112
Published: 2025-06-02
Description: A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-98
References: http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads; https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40112
CVE: CVE-2024-40113
Published: 2025-06-02
Description: Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1392
References: http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads; https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40113
CVE: CVE-2024-40114
Published: 2025-06-02
Description: A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads; https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40114
CVE: CVE-2024-57459
Published: 2025-06-02
Description: A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate user input, allowing an attacker to inject arbitrary SQL commands.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://gist.github.com/b0mk35h/921cfa00f9ea1af[PII_REDACTED]7d38587; https://owasp.org/www-community/attacks/SQL_Injection
CVE: CVE-2025-44115
Published: 2025-06-02
Description: A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/yA0-Z/9666b1a333607381ab8dfcc137f2b65c; https://github.com/Cotonti/Cotonti/issues/1650; https://github.com/Cotonti/Cotonti/issues/1834
CVE: CVE-2025-45542
Published: 2025-06-02
Description: SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/mathurvishal/CloudClassroom-PHP-Project; https://medium.com/@sanjay70023/cve-2025-45542-time-based-blind-sql-injection-in-cloudclassroom-php-project-v1-0-1fa0efc8a94a; http://seclists.org/fulldisclosure/2025/Jun/12
CVE: CVE-2025-48866
Published: 2025-06-02
Description: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the  `sanitiseArg` (or `sanitizeArg`) action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1050
References: https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e; https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r; https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-f82j-8pp7-cw2w
CVE: CVE-2025-48940
Published: 2025-06-02
Description: MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00; https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp; https://mybb.com/versions/1.8.39
CVE: CVE-2025-48941
Published: 2025-06-02
Description: MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1230
References: https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193; https://github.com/mybb/mybb/security/advisories/GHSA-f847-57xc-ffwr; https://mybb.com/versions/1.8.39
CVE: CVE-2024-1440
Published: 2025-06-02
Description: An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.

By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/
CVE: CVE-2024-3509
Published: 2025-06-02
Description: A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section.
To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users.

While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-2701
CVE: CVE-2024-7073
Published: 2025-06-02
Description: A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem.

Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562
CVE: CVE-2024-7074
Published: 2025-06-02
Description: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.

By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/
CVE: CVE-2024-8008
Published: 2025-06-02
Description: A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.

This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/
CVE: CVE-2025-48994
Published: 2025-06-02
Description: SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.
CWE: CWE-303
References: https://github.com/XML-Security/signxml/commit/e3c0c2b82a3329a65d[PII_REDACTED]49c98b8c7600; https://github.com/XML-Security/signxml/security/advisories/GHSA-6vx8-pcwv-xhf4
CVE: CVE-2025-48995
Published: 2025-06-02
Description: SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.
CWE: CWE-208
References: https://github.com/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd; https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42
CVE: CVE-2025-5036
Published: 2025-06-02
Description: A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0009
CVE: CVE-2025-20297
Published: 2025-06-02
Description: In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://advisory.splunk.com/advisories/SVD-2025-0601
CVE: CVE-2025-20298
Published: 2025-06-02
Description: In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732
References: https://advisory.splunk.com/advisories/SVD-2025-0602
CVE: CVE-2025-23104
Published: 2025-06-02
Description: An issue was discovered in Samsung Mobile Processor Exynos 2200. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23104/
CVE: CVE-2025-27953
Published: 2025-06-02
Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url
CVE: CVE-2025-27954
Published: 2025-06-02
Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url; https://portswigger.net/kb/issues/00500700_session-token-in-url
CVE: CVE-2025-27955
Published: 2025-06-02
Description: Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1259
References: https://github.com/intruderlabs/cvex/tree/main/Carestream/session-token-in-url
CVE: CVE-2025-27956
Published: 2025-06-02
Description: Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/intruderlabs/cvex/blob/main/Pixeon/WebLaudos/Directory-Traversal/README.md
CVE: CVE-2025-45387
Published: 2025-06-02
Description: osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/UmerAdeemCheema/CVE-Security-Research/blob/main/OSTicket/Unauthorized%20Access%20to%20Ajax%20Functions.md; https://github.com/osTicket/osTicket; https://github.com/osTicket/osTicket/pull/6802/commits/ab6672faa0991de305d4b90a3faa2e3cebdd23c8
CVE: CVE-2025-5086
Published: 2025-06-02
Description: A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://www.3ds.com/vulnerability/advisories; https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086
CVE: CVE-2025-1051
Published: 2025-06-02
Description: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of ALAC data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25865.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-311/
CVE: CVE-2025-23099
Published: 2025-06-02
Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23099/
CVE: CVE-2025-23105
Published: 2025-06-02
Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23105/
CVE: CVE-2025-49069
Published: 2025-06-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/contact-forms/vulnerability/wordpress-contact-forms-by-cimatti-plugin-1-9-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve