CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- chamilo chamilo-lms, lms +1 moreChamilo: CSRF Vulnerability in Project Deletion8.1 High
- forceu gokapiGokapi: CSRF in Login Endpoint4.6 Medium
- mercurius-js mercuriusMercurius: Incorrect Content-Type parsing can lead to CSRF attack5.4 Medium
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation9.3 Critical
- ghostGhost: Incomplete CSRF protections around OTC use7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group2.3 Low
- nokia impact mobileA Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10...8.1 High
- shenzhen hongyavision technology co., ltd. (sodola networks) sodola sl902-swtgw124as, sodola-network sl902-swtgw124as firmware +1 moreSODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections5.1 Medium
- drupal theme negotiation by rulesTheme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-0124.3 Medium
- chia blockchainChia Blockchain send_transaction cross-site request forgery2.3 Low
- themeisle disable admin notices – hide dashboard notificationsDisable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- talisharTalishar Vulnerable to Cross-Site Request Forgery (CSRF)2.6 Low
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard Missing CSRF Protection on Agent Endpoint8.3 High
- caddyserver caddyCaddy vulnerable to cross-origin config application via local admin API /load (caddy)6.9 Medium
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch CSRF5.1 Medium
- bluditBludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints5.1 Medium
- traccarTraccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints7.3 High
- aruba.it aruba hispeed cacheAruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions5.1 Medium
- shenzhen tenda technology co., ltd. tenda f3, tenda f3 firmware +1 moreTenda F3 CSRF in Web Management Interface5.1 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads7.1 High
- orientdbOrientDB 3.0.17 Cross-Site Request Forgery5.3 Medium
- opentext web site management serverCross Site request forgery vulnerability discovered in OpenText WSM Management Server.5.9 Medium
- wp moose kenta companionWordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- thimpress realpressWordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- themes4wp popularis extraWordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- themastercut revision manager tmcWordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- coachifyWordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- publishpress revisionsWordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wpzita zita elementor site libraryWordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- whatsiplus scheduled notification for woocommerceWhatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action4.3 Medium
- akshayshah5189 remove post type slugRemove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- dienodigital page title, description & open graph updaterPage Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification4.3 Medium
- soyrodriguez country blocker for adsenseCountry Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- spicethemes newsbloggerNewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation8.8 High
- mailchimp list subscribe formMailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change4.3 Medium
- sitzungsdienst sd.net rimSD.NET RIM 4.7.3c - 'idtyp' SQL Injection8.8 High
- openclawOpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow5.9 Medium
- newbee-ltd newbee-mallnewbee-ltd newbee-mall Multiple Endpoints cross-site request forgery5.3 Medium
- webguyio dam spamDam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion4.3 Medium
- jamesits keybase.io verificationKeybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- brikou wp plugin info cardWP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation4.3 Medium
- openclaw, clawdbot +1 moreOpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints7.1 High
- phpgurukul hospital management systemPHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF)...6.5 Medium
- ibm db2 recovery expert for luw, db2 recovery expert +1 moreMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software.6.5 Medium
- phpgurukul gym management systemA Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym...3.5 Low
- dmitritechs wp quick contact usWP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- antevenio mdirector newsletter wordpress pluginMDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery4.3 Medium
- sourcez seatt: simple event attendanceSEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion4.3 Medium
- Show moreLoading…