CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- askywhale games catalogGames Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion4.3 Medium
- veritas infoscale operations managerCross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM)...8.8 High
- scadabrCross-Site request forgery (CSRF) in ScadaBR8.6 High
- bylancer zechatZechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter5.3 Medium
- joomlaextensions joomla! extension joomocshopJoomla JoomOCShop 1.0 Cross-Site Request Forgery5.3 Medium
- jcart for opencartjCart for OpenCart 2.3.0.2 Cross-Site Request Forgery6.9 Medium
- joomsky js jobsJoomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery6.9 Medium
- tp-link tl-wr720n firmware, tl-wr720nmbps wireless n router +1 moreTP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)5.3 Medium
- bloofox bloofoxcmsbloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add6.9 Medium
- textpattern cmsTextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload8.7 High
- wwbn avideoWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA5.7 Medium
- better-authbetter-auth before 1.6.2 OAuth State Validation Bypass6.0 Medium
- vercel turborepoTurborepo: Login callback CSRF/session fixation5.1 Medium
- pektsekye notify odooNotify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- fujitsu japan limited musetheque v4 information disclosure for ipknowledgeCross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for...8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation4.6 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route4.3 Medium
- gitlabCross-Site Request Forgery (CSRF) in GitLab6.5 Medium
- easy2pilotEasy2Pilot 7 Cross-Site Request Forgery via admin.php5.1 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Configuration utility CSRF vulnerability5.3 Medium
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin...9.3 Critical
- warp-tech warpgateWarpgate: SSO CSRF -- State Token Not Validated on Return5.8 Medium
- churchcrm crmChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)8.1 High
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation8.8 High
- gitlawb openclaudeOpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS6.5 Medium
- artica pandora fms, pandora fms fms +1 moreCross-Site Request Forgery on Extension Pages7.1 High
- davidskysa skysa text ticker appSkysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form4.3 Medium
- hemant29 woo commerce minimum weightWoo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form4.3 Medium
- saturngod zawgyi embedZawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter4.3 Medium
- tienrocker tm – wordpress redirectionTm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- phkcorp2005 wp-redirectionWP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- backdrop cms contributed projects backdrop-contrib/salesforceThe Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state...7.1 High
- sap se businessobjects business intelligence platformCross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform5.4 Medium
- getoutline outlineOutline: Slack OAuth state can link a victim Outline account to an attacker Slack identity5.8 Medium
- No product listedHireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All...8.1 High
- opencartOpenCart 3.0.3.7 Cross-Site Request Forgery via account/password5.3 Medium
- opencartOpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery6.9 Medium
- curtainWordPress Plugin Curtain 1.0.2 Cross-site Request Forgery5.3 Medium
- No product listedosTicket Dispatcher class.dispatcher.php cross-site request forgery5.3 Medium
- emlogEmlog: Cross-Site Request Forgery in Admin Functions8.4 High
- divvydrive information technologies inc. divvydriveCSRF in DivvyDrive Information Technologies' DivvyDrive6.5 Medium
- pluginus.net bearWordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- open notebook notebook, lfnovo open-notebook +1 moreSurrealDB Injection on Open Notebook8.7 High
- wpgraphqlWordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- misp misp-modulesmisp-modules website - Missing CSRF protection in the website home blueprint9.3 Critical
- masacmsMasa CMS CSRF in site bundle creation allows unauthorized site data export7.1 High
- masacmsMasa CMS CSRF in content restoration allows unauthorized restoration of deleted content8.7 High
- masacmsMasa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content7.2 High
- masacmsMasa CMS CSRF in user address management allows unauthorized address changes7.1 High
- google chromeInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote...3.1 Low
- Show moreLoading…