CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- b2evolutionb2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)6.9 Medium
- alextselegidis easyappointments, easyappointments easy\!appointments +1 moreCSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover7.4 High
- arunnaArunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)6.9 Medium
- rndsand81 stopwords for commentsStopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery4.3 Medium
- socialchampio auto post to social media from social champSocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- abage sosh share buttonsSosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery4.3 Medium
- obridgeacademy wpblogsynWPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update4.3 Medium
- dashboardbuilder dashboard builder – wordpress plugin for charts and graphsDASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection7.1 High
- sap se fiori app (intercompany balance reconciliation)Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)4.3 Medium
- thm pilosPILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences2.4 Low
- webkul qloappsA CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin...5.4 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion5.4 Medium
- gestsupGestSup <= 3.2.60 CSRF Allows Privileged Actions8.9 High
- creativemotion clearfy cache – wordpress optimization plugin, minify html, css & js, deferClearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering4.3 Medium
- @tanstack react-router, shopify remix-run\/react +1 moreReact Router has CSRF issue in Action/Server Action Request Processing6.5 Medium
- authlibAuthlib: 1-click Account Takeover5.7 Medium
- edubusinesssolutions print shop pro webdeskCross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print...6.8 Medium
- leica geosystems ag geosystems gr10/gr25/gr30/gr50 gnssLeica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request Forgery5.1 Medium
- openchamp simcastSimcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mamurjor employee infoMamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation4.3 Medium
- praveentamil sticky action buttonsSticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- fulippo wp status notifierWP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mtcaptcha wordpress pluginMTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- anwerashif xsharexShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter4.3 Medium
- kentothemes latest tabsLatest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update4.3 Medium
- smjrifle svg map by smjrifleSVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting6.1 Medium
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by improper authentication and missing CSRF protection2.9 Low
- nsthemes ns ie compatibility fixerNS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- helpdeskcom helpdesk contact formHelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args4.3 Medium
- anilankola newsletter email subscribeNewsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission4.3 Medium
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management5.1 Medium
- secure computing snapgear management console sg560, securecomputing snapgear sg560 firmware +1 moreSecure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users5.1 Medium
- p5 fnip-8x16aP5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management5.3 Medium
- thimpress thim coreWordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- automattic wp job managerWordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- emlogEmlog: CSRF chained with stored XSS leads to ATO7.0 High
- phpemsPHPEMS cross-site request forgery5.3 Medium
- themefy bloggieWordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability7.1 High
- omid shamloo pardakht delkhahWordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- emendo seb co-marquage service-public.frWordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- inkthemes wp gmail smtpWordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- saad iqbal post snippetsWordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- appointifyWordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- manidoraisamy formfacadeWordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- serhii pasyuk gmedia photo galleryWordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- mergado packWordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- imdad next web inext woo pincode checkerWordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- eugen bobrowski robots.txt rewriteWordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- channelize.io team live shopping & shoppable videos for woocommerceWordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- Show moreLoading…