CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- murasoftware mura cmsMuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user...8.0 High
- murasoftware mura cmsThe import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and...8.8 High
- edimax gs-5008pl firmware, edimax technology co., ltd. gs-5008pl +1 moreEdimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints5.1 Medium
- admidioAdmidio is Missing CSRF Protection on Role Membership Date Changes5.7 Medium
- admidioAdmidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions5.7 Medium
- hereta eth-imc408m firmware, shenzhen hereta technology co., ltd. hereta eth-imc408m +1 moreHereta ETH-IMC408M CSRF via Configuration Setup5.1 Medium
- raythaCross-Site Request Forgery in Raytha CMS6.9 Medium
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution5.3 Medium
- wowza streaming engineWowza Streaming Engine 4.5.0 CSRF via user edit endpoint6.9 Medium
- wowza streaming engineWowza Streaming Engine 4.5.0 Privilege Escalation via user edit8.7 High
- next click ventures realtyscriptRealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation6.9 Medium
- next click ventuers realtyscriptRealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities6.9 Medium
- zkteco inc. zkbiosecurityZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin5.3 Medium
- janis elsts admin menu editorWordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- josh kohlbach product feed pro for woocommerceWordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- ruben garcia gamipressWordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- desertthemes corpivaWordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- magazine3 easy table of contentsWordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ays pro quiz makerWordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- 10web photo gallery by 10webWordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- shufflehound lemmonyWordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage5.3 Medium
- gvectors wpdiscuzwpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email6.1 Medium
- emlogEmlog asynchronous media file deletion missing CSRF protection0.0 None
- opnsense core, opnsense +1 moreCross-Site Request Forgery (CSRF) in opnsense/core6.3 Medium
- modulards modular ds: monitor, update, and backup multiple websitesModular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth4.3 Medium
- unknown divi-boosterDivi Booster < 5.0.2 - Unauthenticated PHP Object Injection8.1 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting6.1 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php9.7 Critical
- craftcms cms, craft cms +1 moreCraft has a potential information disclosure vulnerability in preview tokens2.3 Low
- unknown court reservationCourt Reservation < 1.10.9 - Event Deletion via CSRF4.3 Medium
- instantcms, instantsoft icms2 +1 moreInstantCMS has Multiple CSRF Vulnerabilities7.1 High
- sunbird sunbirded-portalAn issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd...8.8 High
- oretnom23 computer laboratory management systemSourceCodester Computer Laboratory Management System cross-site request forgery5.3 Medium
- openplatform the guardian news feedThe Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- wpsolutions font pairing preview for landing pagesFont Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- optimizza true rankerTrue Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection4.3 Medium
- themepul purchase button for affiliate linkPurchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial4.3 Medium
- glowlogix wp frontend profileWP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection4.3 Medium
- tomalofficial php oop cms blog, zsoft oop cms blog +1 moreOOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php6.9 Medium
- rul10 easyndexerEasyndexer 1.0 Cross-Site Request Forgery via createuser.php6.9 Medium
- tina4 stackTina4 Stack 1.0.3 Cross-Site Request Forgery via profile6.9 Medium
- sourceforge data center auditData Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php6.9 Medium
- demo alive parishAlive Parish 2.0.4 SQL Injection and Arbitrary File Upload8.8 High
- abc-erp abc erpABC ERP 0.6.4 Cross-Site Request Forgery via _configurar_perfil.php6.9 Medium
- spaghettilearning docebolmsDoceboLMS 1.2 SQL Injection via lesson.php8.8 High
- opensolution quickcmsCross-Site Request Forgery in QuickCMS5.1 Medium
- automattic woocommerceWooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF7.5 High
- unknown wp ecommerceWP eCommerce <= 3.15.1 - Coupon Deletion via CSRF4.3 Medium
- Show moreLoading…