CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- fastgptCross-Site Request Forgery (CSRF) in FastGPT6.9 Medium
- No product listedCross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker...9.0 Critical
- avideo platform, wwbn avideo +1 moreAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)8.5 High
- flexera flexnet publisherFlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)5.1 Medium
- google chromeInappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a...6.5 Medium
- messagemetric mma call trackingMMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- kanboardKanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment5.7 Medium
- rageagainstthepixel unity-cliunity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)5.9 Medium
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy is Missing CSRF Protection on State-Changing Endpoints9.3 Critical
- yokogawa electric corporation fast/tools, yokogawa fast\/tools +1 moreA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This...6.3 Medium
- arkapravamajumder title animatorTITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server < 6.2.7 - Cross-site Request Forgery5.1 Medium
- bdtask business live chat softwareBusiness Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- codesnippetspro code snippetsCode Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions4.3 Medium
- edimax ew-7438rpn mini firmware, edimax technology ew-7438rpn mini +1 moreEdimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution5.1 Medium
- hrsaleHRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- exagate sysguard 6001Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- p5 fnip-8x16aP5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- axigen mail serverAxigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery...8.8 High
- ibm operations analytics - log analysisIBM Operations Analytics - Log Analysis is affected by CSRF Token Replay Attack4.3 Medium
- lcg0124 bootdolcg0124 BootDo cross-site request forgery5.3 Medium
- edimax ew-7438rpn mini firmware, edimax technology ew-7438rpn mini +1 moreEdimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)5.1 Medium
- maian media support helpdeskMaian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)5.1 Medium
- qwik[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)5.9 Medium
- qwikQwik City has a CSRF Protection Bypass via Content-Type Header Validation5.9 Medium
- shenzhen tenda technology co., ltd. tenda ac7, tenda ac7 firmware +1 moreTenda AC7 Web Interface Lacks CSRF Protections for Admin Actions5.1 Medium
- gunet open eclass platform, openeclass +1 moreOpen eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions6.5 Medium
- blair williams thirstyaffiliatesWordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- stiofan userswpWordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- themelooks enter addonsWordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wp.insider simple membership wp user importWordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- copyscape premiumWordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- brainstorm force sigmizeWordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- elecom co.,ltd. wrc-x1500gs-b, wrc-x1500gsa-b, wrc-x1800gs-b +12 more +14 moreCross-site request forgery vulnerability exists in WRC-X1500GS-B and WRC-X1500GSA-B. If a user...5.1 Medium
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting5.4 Medium
- polarlearnPolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)2.3 Low
- enalean tuleapTuleap is missing CSRF protection in the Overview inconsistent items4.6 Medium
- rustaurius five star restaurant reservationsFive Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF4.3 Medium
- oretnom23 medical certificate generator appSourceCodester Medical Certificate Generator App cross-site request forgery5.3 Medium
- ays-pro popup box – create countdown, coupon, video, contact form popupsPopup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change4.3 Medium
- navigate cms, naviwebs navigate cms +1 moreNavigate CMS 2.8.7 - Cross-Site Request Forgery5.1 Medium
- adikiss sistem informasi pengumuman kelulusan onlineSistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery5.1 Medium
- midgetspy sickbeardSickbeard 0.1 - Cross-Site Request Forgery5.1 Medium
- birkir primebirkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL5.1 Medium
- salihciftci limanLiman 0.7 - Cross-Site Request Forgery (Change Password)5.1 Medium
- webguyio stop spammers classicStop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist4.3 Medium
- flexense disk pulse enterprise, sync breeze enterprise server +1 moreauthenticated reflected XSS vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- flexense disk pulse enterprise, sync breeze enterprise server, diskpulse +1 more +3 moreCross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server8.5 High
- Show moreLoading…