CVE-2025-67465CWE-352csrf

CVE-2025-67465

Medium · published December 9, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

⚠️ A crafty CSRF vulnerability lurks in QuantumCloud's Simple Link Directory, allowing attackers to perform actions on behalf of unsuspecting users. 🤖 Think of this like a sneaky waiter who takes your order and then serves someone else’s meal without checking, leaving you wondering why you got spaghetti when you ordered sushi! 🍣 An attacker could trick a logged-in user into executing unwanted actions, potentially leading to unauthorized data changes or access. While not an immediate catastrophe, the potential misuse of user privileges can certainly cause a headache for everyone involved!

Put simply

Think of this like a sneaky waiter who takes your order and then serves someone else’s meal without checking, leaving you wondering why you got spaghetti when you ordered sushi! 🍣 This CSRF vulnerability allows attackers to exploit the lack of proper verification in requests made by authenticated users, meaning they can forge requests without user consent.

What to do

An attacker could trick a logged-in user into executing unwanted actions, potentially leading to unauthorized data changes or access. While not an immediate catastrophe, the potential misuse of user privileges can certainly cause a headache for everyone involved! To protect against this vulnerability, update Simple Link Directory to version 8.8.4 or later. Additionally, implement Anti-CSRF tokens to validate requests and educate your users about potential phishing attempts. 🛡️ You've got this! By following these steps, you’ll keep your application safe and sound! 🔒

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-09T21:18Z
References (1)
EPSS history
Timeline
  • 09 DEC 14:13Z
    WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability
    cvelistv5