CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- enalean tuleapTuleap has missing CSRF protections in its tracker trigger management system4.6 Medium
- enalean tuleapTuleap is missing CSRF protections for its planning management API4.6 Medium
- enalean tuleapTuleap has a Cross-Site Request Forgery (CSRF) vulnerability4.6 Medium
- circl vulnerability-lookupCSRF vulnerability in CIRCL Vulnerability-Lookup7.0 High
- phpipamphpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export...3.3 Low
- xbenx wp landing pageWP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update4.3 Medium
- fit2cloud halofit2cloud Halo cross-site request forgery5.3 Medium
- hedgedocHedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF3.7 Low
- vinoth06 user generator and importerUser Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation8.8 High
- wcvendors wc vendors – woocommerce multivendor, woocommerce marketplace, product vendorsWC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion4.3 Medium
- alexkar ark related postsARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update4.3 Medium
- torod – the smart shipping and delivery portal for e-shops and retailersTorod – The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification4.3 Medium
- duddi image optimizer by wps.skImage Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization4.3 Medium
- breadbutter bread & butter: ai-powered lead intelligence, bread \& butter +1 moreBread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload4.3 Medium
- kaushikankrani hide categories or products on shop pageHide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mrdenny time sheetsTime Sheets <= 2.1.3 - Cross-Site Request Forgery4.3 Medium
- monkeyboz quantic social image hoverQuantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update4.3 Medium
- teamdream dream gallerydream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action6.1 Medium
- contentstudioContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- jevgenisultanov norby aiNorby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- watchful backup, restore and migrate your sites with xclonerBackup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()4.3 Medium
- synology diskstation manager (dsm), diskstation manager, unified controller (dsmuc) +1 more +3 moreCross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation...9.6 Critical
- romm.app rommRomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover7.6 High
- drupal login time restrictionLogin Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-1208.1 High
- roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solutionShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation4.3 Medium
- objectplanet opinioThe feature to manage resources is prone to Cross-Site Request Forgery attacks2.3 Low
- devsoftbaltic surveyjs: drag & drop form builderSurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion4.3 Medium
- ays-pro photo gallery by ays – responsive image galleryPhoto Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions4.3 Medium
- smackcoders export all posts, products, orders, refunds & usersExport All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure6.5 Medium
- socomec diris digiware m-70, diris m-70 firmware +1 moreA cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of...7.5 High
- tekrom technology inc. t-soft e-commerceCSRF in Tekrom Technology's T-Soft E-Commerce5.4 Medium
- publiccmsPublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the...8.8 High
- scada-ltsScada-LTS cross-site request forgery5.3 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability6.8 Medium
- nextendweb nextend social login and registerNextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login4.3 Medium
- hcltech unicaCross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.5.5 Medium
- assafp quiz, poll & survey maker by opinion stagePoll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection4.3 Medium
- reuters news agency direct, rnags reuters direct +1 moreReuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- anyscale rayRay is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack9.4 Critical
- unknown tax service electronic hdmTax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution8.6 High
- webgarh peer publishPeer Publish <= 1.0 - Cross-Site Request Forgery4.3 Medium
- evolurise conditionnal maintenance mode for wordpressConditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery4.3 Medium
- sony corporation snc-cx600w, sony snc-cx600w firmware +1 moreCross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a...2.1 Low
- ilevia eve x1 server firmwareCross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18...9.6 Critical
- magewell ultra encode aio firmware, ultra encode hdmi firmware, ultra encode hdmi plus firmware +2 more +4 moreA Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro...6.5 Medium
- magewell pro convert 12g sdi 4k plus firmware, pro convert aes67 firmware, pro convert audio dx firmware +10 more +12 moreA Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro...5.7 Medium
- tuya smartlife, tuya, tuya smart +2 moreCross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0...8.8 High
- langfuseLangfuse SSO Account Takeover via CSRF or phishing attack6.5 Medium
- zozothemes zegen coreZegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- igor jerosimić i order termsWordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- Show moreLoading…