CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- tautulliTaultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover8.8 High
- simcy creative pdf signerPDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie9.3 Critical
- planetshaker emergencywp – dead man's switch & legacy deliveranceEmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- namelessmc namelessNamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping5.4 Medium
- pcis laiser tagLaiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form4.3 Medium
- jamesmuga remove nofollow commenter urlRemove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- mr mat remove meta boxes per user roleRemove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update4.3 Medium
- russellr tectite formsTectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- ddd2500 google plus one bottomGoogle Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page4.3 Medium
- birdseedapp birdseedBirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change4.3 Medium
- zeuscartZeusCart 4.0 Deactivate Customer Accounts CSRF6.9 Medium
- deepai api.deepai.orgDeepAI api.deepai.org/change_user_email CSRF2.3 Low
- soplanningCross-Site Request Forgery in SOPlanning5.1 Medium
- admidioAdmidio PKCS#12 private key export action lacks CSRF protection4.3 Medium
- admidioAdmidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation5.4 Medium
- admidioAdmidio's CSRF in registration `send_login` mode resets arbitrary user passwords5.2 Medium
- joeyrush php-shop masterPHP-SHOP 1.0 Cross-Site Request Forgery via users.php6.9 Medium
- sitejo hape pkhHaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php6.9 Medium
- david lingren media library assistantMedia Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form8.1 High
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...7.9 High
- yudiz wp contact form 7 db handlerWP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter8.1 High
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi)PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink4.3 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter4.3 Medium
- budibaseBudibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker6.5 Medium
- jenkins multijob, jenkins project multijob plugin +1 moreJenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability4.3 Medium
- jenkins project github integration plugin, kostyasha github integration +1 moreJenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability4.3 Medium
- lhughes33472 metamagic seo pluginMetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page4.3 Medium
- rahulbhangale wp promoterWP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter6.1 Medium
- zte zxunipos nds-lteCross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product5.3 Medium
- shra genzel breadcrumbsGenzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page4.3 Medium
- mkhfr old posts highlighterOld Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- godlessons wp autobuzzWP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter6.1 Medium
- youtag two-factor authentication (formerly ip vault)Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- rchmura gostats for wordpressGoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function4.3 Medium
- wmark cdn linker liteCDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- simonailie search simple fieldsSearch Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- nakamura1458 auto making json-ldauto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass4.3 Medium
- creativemindssolutions cm ad changer – a simple tool to control and optimize your site's bannersCM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management4.3 Medium
- Show moreLoading…