CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- wwbn avideoWWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php4.3 Medium
- emlogEmlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write8.7 High
- openclawOpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints2.3 Low
- ibm datapower gateway 10.5.0, datapower gateway 10.6.0, datapower gateway 10.6cd +1 more +3 moreIBM DataPower Gateway vulnerable to CSRF6.5 Medium
- payloadcms payloadPayload has a CSRF Protection Bypass in Authentication Flow5.4 Medium
- google chromeInappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote...6.5 Medium
- wwbn avideoAVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins6.5 Medium
- wwbn avideoAVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users6.5 Medium
- wwbn avideoAVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking8.1 High
- admidioAdmidio: Missing CSRF Protection on Registration Approval Actions4.5 Medium
- admidioAdmidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter4.3 Medium
- admidioAdmidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php4.6 Medium
- teckel minify htmlMinify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update5.4 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UI7.1 High
- synacor zimbra collaboration suiteAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery...8.8 High
hackage-serverHackageHackage CSRF vulnerability9.6 Critical- sourcecodester note taking appSourceCodester Note Taking App cross-site request forgery5.3 Medium
- sourcecodester diary appSourceCodester Diary App diary.php cross-site request forgery5.3 Medium
- botpressBotpress - Credential Disclosure via Twilio Webhook Handler8.2 High
- themifyme conditional menusConditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update4.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable to cross-site request forgery4.3 Medium
- gitlabCross-Site Request Forgery (CSRF) in GitLab8.1 High
- mattermost, mattermost server +1 moreCSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint4.6 Medium
- ericsson indoor connect 8855, indoor connect 8855 firmware +1 moreEricsson Indoor Connect 8855 - Cross-Site Request Forgery Vulnerability5.1 Medium
- dedecmsDedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in ...8.8 High
- wwbn avideoAVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification8.1 High
- kalcaddle kodboxkalcaddle kodbox loginSubmit API index.class.php cross-site request forgery2.3 Low
- nexxt solutions nebula 300+, nexxtsolutions nebula300plus firmware +1 moreMissing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+7.2 High
- phy9pas post snippitsPost Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update6.1 Medium
- neo2oo5 neos connector for fakturamaNeos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update4.3 Medium
- invelity product feedsInvelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion8.1 High
- frankkoenen plugin name: login registerlogin_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting4.3 Medium
- chuckmo lobot slider administratorLobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- superrishi sr wp minify htmlSR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- xhanch studio – my advanced settingsXhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- haghs redirect countdownRedirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- omarnas add google social profiles to knowledge graph boxAdd Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- suifengtec wp posts re-orderWP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- wwbn avideoAVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload8.8 High
- precurio intranet portalPrecurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload8.6 High
- joshuae1974 flash video playerWordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability7.1 High
- synacor zimbra collaboration suiteAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery...5.4 Medium
- lfprojects mcp go sdk, modelcontextprotocol go-sdk +1 moreMCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion7.1 High
- pattihis add custom fields to mediaAdd Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter4.3 Medium
- ajk automated logoutAutomated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-0304.3 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +74 more +76 moreCross‑Site Request Forgery in Link Aggregation Configuration7.1 High
- murasoftware mura cmsMuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently...8.1 High
- murasoftware mura cmsThe update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate...7.1 High
- murasoftware mura cmsThe Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore...8.8 High
- murasoftware mura cmsMuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality ...6.5 Medium
- Show moreLoading…