CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- passionate programmer peter wp data access WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability 6.5 Medium
- blubrry powerpress podcasting WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High
- supsystic photo gallery by supsystic WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability 6.3 Medium
- suplugins superb addons: blocks, patterns & theme designer WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High
- wpmet wp social WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium
- unknown komfortkasse for woocommerce Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF 8.8 High
- jgwhite33 wp google review slider WP Google Review Slider < 18.11 - Google API Settings Update via CSRF 4.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.4 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.4 Medium
- open-emr openemr OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations 7.1 High
- apache software foundation juneau Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override 10.0 Critical
- presenton Presenton User Configuration user-config JSON.parse cross-site request forgery 5.3 Medium
- nliautaud pico-content-editor nliautaud pico-content-editor cross-site request forgery 5.3 Medium
- vtenext vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering 6.9 Medium
- sharpemu SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution 8.3 High
- akeeba ltd. admin tools for joomla!, backup for joomla!, backup for wordpress +1 more +3 more Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious... 5.1 Medium
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields No score - github enterprise server Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console 5.3 Medium
- franklioxygen mytube MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value 6.8 Medium
- amir1376 ab-download-manager AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF 8.7 High
- absolute security secure access CSRF in Secure Access Server v14.60 9.4 Critical
- php-web-design.com stageit extension for joomla Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5 7.2 High
- thelia back-office default twig template Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes 6.9 Medium
- thelia page module Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes 7.0 High
- thelia, thelia back-office default template, back-office default twig template +2 more +4 more Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions 5.9 Medium
-
adminneo-org/adminneoPackagist AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery 6.8 Medium - morpheus65535 bazarr Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery 10.0 Critical
- saad iqbal apiexperts square for woocommerce WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium
- jordy meow ai engine WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High
- chamilo chamilo-lms Chamilo LMS: CSRF in destructive skill-management AJAX actions 6.5 Medium
- fossbilling FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API 5.1 Medium
- phpmyadmin phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql 7.7 High
- element-hq element-desktop, element-web +1 more Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters 7.1 High
- labredescefetrj wegia WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes 8.1 High
- wpfunnels WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium
- instawp connect WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High
- sabbatic app Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application 4.8 Medium
- opajaap wp photo album plus WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF 4.3 Medium
- supsysticcom contact form by supsystic Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF 4.3 Medium
- supsysticcom contact form by supsystic Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF 5.4 Medium
- labstack echo Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method 5.3 Medium
- drupal fasttoggle Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 6.5 Medium
- drupal commerce stripe Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 7.3 High
- drupal commerce core Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 5.3 Medium
- caseproof, llc memberpress Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter 8.8 High
- e4jvikwp vikrentcar car rental management system VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task 8.8 High
- david lingren media library assistant Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF 6.5 Medium
- david lingren media library assistant Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF 6.5 Medium
- crushftp CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ 8.6 High
- tribulant software newsletters WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability 9.6 Critical
- Show olderLoading…