CVE-2026-125445

MediumCVSS 4.3/10Last modified Nov 11, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Infomaniak Network	VOD Infomaniak	<= 1.5.16

References

https://patchstack.com/database/wordpress/plugin/vod-infomaniak/vulnerability/wordpress-vod-infomaniak-plugin-1-5-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1254468.8Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affe CVE-2026-1254485.3Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Leve CVE-2026-125456.7A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component di CVE-2026-1254506.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank all CVE-2026-1254516.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stor CVE-2026-1254527.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allow CVE-2026-1254546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector al CVE-2026-1254556.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-pag CVE-2026-125473.4SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuratio CVE-2026-125484.2A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and s CVE-2026-125494.8The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed compariso CVE-2026-12557.5The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the '