CVE-2025-67465: CSRF in QuantumCloud Simple Link Directory

A successful CSRF attack against Simple Link Directory could allow an attacker to modify directory entries, delete links, or perform other administrative actions as the logged-in user. The impact is directly proportional to the privileges of the user being targeted. For example, an administrator account could be compromised, granting the attacker full control over the directory and potentially the associated website. This could lead to data breaches, website defacement, or denial of service. While CSRF typically requires social engineering to trick a user into clicking a malicious link, automated attacks are also possible.

1. Reserved2025-12-08
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67465 is to upgrade Simple Link Directory to version 8.8.4 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing a Content Security Policy (CSP) to restrict the origins from which the directory can be loaded. Additionally, implement strict input validation and output encoding to prevent malicious scripts from being injected. Web Application Firewalls (WAFs) can be configured with CSRF protection rules to block suspicious requests. After upgrading, verify the fix by attempting to submit a request with a forged origin header and confirming that it is rejected.

Active installs

2KPopular

Plugin rating