CVE-2025-29722

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cypherdavy/CVE-2025-29722Exploit, Third Party Advisory
https://github.com/yassmittal/CommercifyProduct

Timeline

Published: Apr 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-29739.8A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of CVE-2025-29745.4A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code o CVE-2025-297436.5D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.CVE-2025-297445.4pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.CVE-2025-297457.5A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NT CVE-2025-297466.1Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and CVE-2025-29755.4A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file S CVE-2025-297568.3SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devic CVE-2025-297579.4An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid CVE-2025-29765.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the componen CVE-2025-297664.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on arti CVE-2025-297684.4Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impac