Cross-Site Request Forgery Vulnerability in Vulnerability-Lookup by Vendor

CVE-2025-42616

What is CVE-2025-42616?

The Vulnerability-Lookup application contains a significant flaw that allows state-modifying operations through HTTP GET requests without CSRF token validation. This vulnerability permits an attacker to exploit the application's design by tricking a logged-in user into visiting a malicious site, potentially executing unintended state-altering actions as though they were the authenticated user. The exploitation can lead to privilege escalation and unauthorized alterations of settings and configurations. The resolution requires all state-changing requests to utilize HTTP POST methods along with valid CSRF tokens, effectively mitigating the risk of arbitrary GET requests triggering state changes.

References