CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- mattermost, mattermost server +1 moreCSRF Protection Bypass Allows Updating a User's Authentication Method6.8 Medium
- faridsaniee open-brainOPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery6.1 Medium
- petjeaf petje.afPetje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action4.3 Medium
- udamadu inquiry form to posts or pagesInquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter4.3 Medium
- wwbn avideoWWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators5.4 Medium
- wwbn avideoAVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion5.4 Medium
- wwbn avideoWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)7.1 High
- wwbn avideoWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials8.3 High
- goshsgoshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation6.1 Medium
- pachnoPachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints5.3 Medium
- heatmiser wifi thermostatHeatmiser Wifi Thermostat 1.7 Cross-Site Request Forgery5.3 Medium
- montala resourcespaceResourceSpace 8.6 SQL Injection via collection_edit.php7.1 High
- deepwisdom metagptFoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery5.3 Medium
- arubadev aruba hispeed cacheAruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset4.3 Medium
- 10ij dockyardDockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation6.5 Medium
- phpbbCross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.4.3 Medium
- phpbbCross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism8.8 High
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a...4.3 Medium
- zammadZammad has Cross-site request forgery (CSRF) in OAuth callback endpoints5.9 Medium
- vsourz1td advanced contact form 7 dbAdvanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion5.4 Medium
- realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.netBEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification6.5 Medium
- realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.netBEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion4.3 Medium
- stmcan rt-theme 18 | extensionsWordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- dotstore extra fees plugin for woocommerceWordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- skywarrior blackfyreWordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- mndpsingh287 theme editorWordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability9.6 Critical
- themegoods grand magazineWordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- themegoods grand portfolioWordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- themegoods grand car rentalWordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- themegoods grand blogWordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- spicethemes spicepressWordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability8.8 High
- priyanshumittal appointmentWordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability9.6 Critical
- priyanshumittal busiprofWordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability9.6 Critical
- themearile newsexoWordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- priyanshumittal bluestreetWordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability9.6 Critical
- themegoods grand photographyWordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- edckwt quran translationsQuran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form4.3 Medium
- jkohlbach product feed pro for woocommerce by adtribes – product feeds for woocommerceProduct Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions8.8 High
- wp chill download monitorDownload Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling5.4 Medium
- redwoodjs redwoodsdk, sdk +1 moreRedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests8.1 High
- analytify simple social media share buttonsWordPress Simple Social Media Share Buttons plugin <= 6.2.0 - Cross Site Request Forgery (CSRF) vulnerability7.5 High
- analytify under construction, coming soon & maintenance modeWordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability7.5 High
- wwbn avideoWWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write4.3 Medium
- projectsendProjectSend upload.php cross-site request forgery5.3 Medium
- victoralagwu cmssiteCMSsite 1.0 Cross-Site Request Forgery via users.php5.3 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 cross-site request forgery5.3 Medium
- nodcmsNodcms Cross Site Request Forgery via admin endpoints5.3 Medium
- redaxo, redaxo cms +1 moreRedaxo CMS 5.2 Cross-Site Request Forgery via users endpoint6.9 Medium
- snewscms snews, snews cms cross site request forgery +1 moreSnews CMS 1.7 Cross-Site Request Forgery via changeup6.9 Medium
- Show moreLoading…