CVE-2025-55044

The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests that restore content to arbitrary parent locations when an authenticated administrator visits a crafted webpage. Successful exploitation of the Trash Restore CSRF vulnerability results in unauthorized restoration of deleted content to potentially inappropriate or malicious locations within the MuraCMS website structure. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that restores specified content from the trash to a location determined by the attacker through the parentid parameter. This can lead to restoration of previously deleted malicious content, placement of sensitive documents in public areas, manipulation of website navigation structure, or restoration of outdated content that was intentionally removed for security or compliance reasons.

• CWE-352

• https://docs.murasoftware.com/v10/release-notes/Release Notes
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014Release Notes
• https://www.murasoftware.comProduct

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55038An authorization bypass vulnerability has been discovered in…7.6
• CVE-2025-55039This issue affects Apache Spark versions before 3.4.4, 3.5.…6.5
• CVE-2025-5504A vulnerability has been found in TOTOLINK X2000R 1.0.0-B202…6.3
• CVE-2025-55040The import form CSRF vulnerability in MuraCMS through 10.1.1…8.8
• CVE-2025-55041MuraCMS through 10.1.10 contains a CSRF vulnerability in the…8
• CVE-2025-55043MuraCMS through 10.1.10 contains a CSRF vulnerability in the…6.5
• CVE-2025-55045The update address CSRF vulnerability in MuraCMS through 10.…7.1
• CVE-2025-55046MuraCMS through 10.1.10 contains a CSRF vulnerability that a…8.1
• CVE-2025-55047CWE-798 Use of Hard-coded Credentials8.4
• CVE-2025-55048Multiple CWE-789.8
• CVE-2025-55049Use of Default Cryptographic Key (CWE-1394)9.1
• CVE-2025-5505A vulnerability was found in TOTOLINK A3002RU 2.1.1-B2023072…4.8