https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:54:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252386 EUVD-2026-252386 https://cve.radiocsirt.org/vuln/euvd-2026-252386 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58430 <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.</p> <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58430 https://cve.radiocsirt.org/vuln/ghsa-rf24-wg77-gq7w <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary</p> <p>Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.</p> <p>### Details</p> <p>During a security evaluation of the webapp, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly.</p> <p>This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability.</p> <p>Example HTTP request without nonce : &lt;img width=&#34;1418&#34; height=&#34;772&#34; alt=&#34;user_creation_without_nonce_burp_request&#34; src=&#34;https://github.com/user-attachments/assets/a5026cdd-d360-4919-ae66-29856c3d3f32&#34; /&gt;</p> <p>### PoC</p> <p>Let&#39;s look at a “chain” case of vulnerabilities that include the CSRF and XSS.</p> <p>An admin (or any user with permissions) can create templates and preview them (`POST /api/templates/preview` ) making it possible to execute javascript code. For example:</p> <p>&lt;img width=&#34;1912&#34; heigh…</p> <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary</p> <p>Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.</p> <p>### Details</p> <p>During a security evaluation of the webapp, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly.</p> <p>This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability.</p> <p>Example HTTP request without nonce : &lt;img width=&#34;1418&#34; height=&#34;772&#34; alt=&#34;user_creation_without_nonce_burp_request&#34; src=&#34;https://github.com/user-attachments/assets/a5026cdd-d360-4919-ae66-29856c3d3f32&#34; /&gt;</p> <p>### PoC</p> <p>Let&#39;s look at a “chain” case of vulnerabilities that include the CSRF and XSS.</p> <p>An admin (or any user with permissions) can create templates and preview them (`POST /api/templates/preview` ) making it possible to execute javascript code. For example:</p> <p>&lt;img width=&#34;1912&#34; heigh…</p> https://cve.radiocsirt.org/vuln/ghsa-rf24-wg77-gq7w https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1 <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1