CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- pluginops feather login pageWordPress Feather Login Page plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- kunal custom 404 proWordPress Custom 404 Pro plugin <= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- dipesh patel web to sugarcrm leadWeb to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion4.3 Medium
- tikolan wp hallo weltWP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- wpmaniax wp db boosterWP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup4.3 Medium
- nestornoe amazon affiliate lite pluginAmazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update5.4 Medium
- edckwt quran gatewayQuran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- fastapi-users project fastapi users, fastapi-users +1 moreFastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO5.9 Medium
- restajet online food delivery systemCSRF in Restajet's Online Food Delivery System7.1 High
- turms-im turmsCross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows...6.1 Medium
- freshrssFreshRSS has Logout CSRF that Leads to DoS via <track src>5.3 Medium
- opensourcepos open source point of sale, opensourcepos +1 moreopensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation8.8 High
- ercom cryptoboxCSRF in Ercom Cryptobox administration console0.6 Low
- mattermost, mattermost server +1 moreCSRF Allows Call Initiation and Message Delivery4.3 Medium
- wpcodefactory download plugins and themes in zip from dashboardDownload Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival4.3 Medium
- growi, inc. growiCross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a...5.1 Medium
- ritecmsA Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0...6.8 Medium
- nardamiteq upc2 firmwareCSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker...8.8 High
- keepassxc keepassxc-browserKeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents...7.1 High
- meks quick plugin disablerWordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- semrush cy ltd content toolkitWordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- freshchatWordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- yoav farhi rtl testerWordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aerin quick interest sliderWordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- astoundify listifyWordPress Listify theme <= 3.2.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- loopus wp attractive donations system - easy stripe & paypal donationsWordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks...8.8 High
- weblateWeblate has Server-Side Request Forgery vulnerability5.0 Medium
- melodicmedia popover windowsPopover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update4.3 Medium
- owais4377 lucky draw contestsLucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- ays-pro image slider by ays- responsive slider and carouselImage Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion4.3 Medium
- openplc v3 v3OpenPLC_V3 Cross-Site Request Forgery7.0 High
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion4.3 Medium
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export4.3 Medium
- sparkle wp construction lightConstruction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation4.3 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreCross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0,...5.1 Medium
- darendev simple theme changerSimple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update4.3 Medium
- frapesce rabbit holeRabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- justdave upcoming for calendlyUpcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update4.3 Medium
- codnloc purchase and expense managerPurchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion4.3 Medium
- tekafran animated pixel marquee creatorAnimated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter4.3 Medium
- truefy embedTruefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update4.3 Medium
- doubledome resource library for logged in usersResource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions4.3 Medium
- developerke kirim.email woocommerce integrationKirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update4.3 Medium
- imaqpress imaq coreIMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update4.3 Medium
- octagonsimon coding blocksCoding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- foxtheme foxtool all-in-one: contact chat button, custom login, media optimize imagesFoxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection4.3 Medium
- magblogapi bmlt wordpress satelliteBMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion4.3 Medium
- vercel next.jsNext.js: null origin can bypass Server Actions CSRF checks5.3 Medium
- easyimages2.0 project easyimages2.0A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8...8.8 High
- Show moreLoading…