CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of...6.3 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery5.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260505] - CSRF in user activation endpoint4.6 Medium
- e107inc e107e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()6.5 Medium
- zohocorp zoho mail wordpress pluginCross-site Request Forgery5.7 Medium
- bgermann cformsiiWordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- convers lab wpsubscriptionWordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- recorp export wp page to static html/cssWordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- wpdevart organization chartWordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System cross-site request forgery5.3 Medium
- admidioAdmidio 3.3.5 Cross-Site Request Forgery via roles_function.php6.9 Medium
- fyffe php-twitter-cloneTwitter-Clone 1 Cross-Site Request Forgery via tweetdel.php5.3 Medium
- jomresJoomla Component jomres 9.11.2 Cross-Site Request Forgery5.3 Medium
- behance smartshopSmartshop 1 Cross-Site Request Forgery via editprofile.php5.3 Medium
- calcom cal.diycalcom cal.diy cross-site request forgery5.3 Medium
- bestpractical rtRT has broken CSRF protection for authenticated users7.1 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion2.3 Low
- kasparsd widget contextWidget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter4.3 Medium
- pftool alfie – feed pluginAlfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter4.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE7.5 High
- concrete cms cms, concretecms concrete cms +1 moreCSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller7.5 High
- mattermost, mattermost mobile +1 moreMobile SSO authentication flow allows credential theft via malicious server6.1 Medium
- sitemio information technologies trade ltd. co. wisecpCSRF in Sitemio's WISECP8.0 High
- simonholliday anomify ai – anomaly detection and alertingAnomify AI <= 0.3.6 - Cross-Site Request Forgery4.3 Medium
- winking word 2 cashWord 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page6.1 Medium
- svil4ok bottom barBottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- helpstring child height predictor by ostheimerChild Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form4.3 Medium
- jay patel remove yellow bgboxRemove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery4.3 Medium
- submone amazon scraperAmazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update4.3 Medium
- rdbeach blogchat chat systemBLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update6.1 Medium
- eazyserver sentence to seo (keywords, description and tags)Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters6.1 Medium
- javibola custom theme testJaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery4.3 Medium
- ktulhu bigfishgames syndicateBigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update4.3 Medium
- Show moreLoading…