Sushmita Poudel

The issue concerns the Sensei LMS WordPress plugin, where some of its REST API routes are not properly protected, allowing unauthenticated attackers to leak email templates.

The issue lacks CSRF checks, allowing a user to invite any user to any group, including private groups.

Zitadel is an open source identity management system that uses HTML for emails and renders certain information such as usernames dynamically. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI.

The issue allows any authenticated user to join a private group due to a missing authorization check on a function.

The issue is related to the lack of CSRF checks in certain areas, which could allow attackers to make users join private groups via a CSRF attack.

The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to manipulate users into voting on polls they do not have access to through a CSRF attack.

The issue concerns the lack of CSRF checks in certain areas, allowing attackers to perform unwanted actions on logged-in users through CSRF attacks. This includes actions such as declining and accepting group invitations or leaving a group.

The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to make logged-in admins unpublish downloads via a CSRF attack. This could be exploited by tricking administrators into performing unintended actions.

The issue concerns a lack of CSRF checks in certain areas of the plugin, which could allow attackers to trick logged-in administrators into deleting downloads via a CSRF attack.