CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.2.6 Low
- wwbn avideoWWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes5.4 Medium
- jupyter jupyterhubJupyterHub: Cross-origin form POSTs bypass XSRF5.4 Medium
- foux publish 2 ping.fmPublish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter6.1 Medium
- xavortm dx sourcesDX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- kazunii addfreespaceaddfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page4.3 Medium
- davidvongries ultimate dashboard – custom wordpress dashboardUltimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation4.3 Medium
- benjaminprojas wp editorWP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor8.8 High
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U...8.8 High
- dbitnet dbit n300 t1 pro firmwareA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the...8.8 High
- admidioAdmidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send3.5 Low
- ckanCKAN: CSRF exemption primed by anonymous requests6.1 Medium
- videoflow ltd. digital video protectionVideoFlow Digital Video Protection DVP 2.10 - Authenticated Remote Code Execution5.3 Medium
- merge pacsMerge PACS 7.0 Cross-Site Request Forgery via merge-viewer6.9 Medium
- modelcontextprotocol rust-sdkRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport8.8 High
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel cross-site request forgery5.3 Medium
- No product listedCross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before...8.8 High
- redwoodjs redwoodsdk, sdk +1 moreRedwoodSDK: Same-site CSRF in in server actions5.3 Medium
- taqnixTaqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action4.3 Medium
- frappe pressFrappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation6.6 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Cross-Site request forgery8.4 High
- goshsgoshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS6.5 Medium
- gitlabCross-Site Request Forgery (CSRF) in GitLab8.1 High
- themefusion avadaWordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
engramxnpmengram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection8.6 High- byybora google pagerank displayGoogle PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page4.3 Medium
- nofearinc dx unanswered commentsDX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update4.3 Medium
- ksolves kcaptchaKcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- ravster inquiry cartInquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form6.1 Medium
- chsxf mcatfiltermCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function4.3 Medium
- tmarek call to action pluginCall To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update4.3 Medium
- webarea fast & fancy filter – 3fFast & Fancy Filter – 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action4.3 Medium
- anzia ni woocommerce order exportNi WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action4.3 Medium
- textp2p texting widgetTextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- sphex1987 wp responsive popup + optinWP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter6.1 Medium
- freescout-help-desk freescoutFreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable5.4 Medium
- mozilla firefox, thunderbird +1 moreOther issue in the Networking: DNS component5.3 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: postMessage component6.5 Medium
- dovestones ad self updateDovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF)....6.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints5.5 Medium
- No product listedComfyUI server.py create_origin_only_middleware cross-site request forgery5.3 Medium
- apache apache-airflow-providers-keycloak, apache software foundation airflow providers keycloak +1 moreApache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager5.4 Medium
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion8.1 High
- pac4jCross-Site Request Forgery in PAC4J7.0 High
- tholstkabelbwde plugin: cms für motorrad werkstättenCMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery4.3 Medium
- authlibAuthlib: Cross-site request forging when using cache5.4 Medium
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- deluxethemes userproWordPress Userpro plugin < 5.1.11 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- woobeewoo product pricing table by woobewooProduct Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion6.1 Medium
- Show moreLoading…