CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- symfony uxSymfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted2.1 Low
- apache apisixApache APISIX: cas-auth login CSRF / session injection issue2.1 Low
- adamsilverstein user admin simplifierUser Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery4.3 Medium
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- ubb systems ubb.threadsCross-Site Request Forgery in UBB.threads8.6 High
- cotontiCotonti CSRF in PFS folder edit allows unauthorized folder modification5.3 Medium
- cotontiCotonti CSRF in PFS allows forced arbitrary file upload8.6 High
- cotontiCotonti CSRF in admin.rights.php allows privilege escalation9.4 Critical
- cotontiCotonti CSRF in admin.config.php allows unauthorized configuration changes8.7 High
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action4.3 Medium
- simplcommerceCross-Site Request Forgery (CSRF) in SimplCommerce News Module6.9 Medium
- andy moyle emergency password resetWordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- extend themes skyline wpWordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- premiumpress limited. wordpress dating themeWordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability8.8 High
- oracle human resourcesVulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person...7.5 High
- oracle isupplier portalVulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home...8.0 High
- oracle mysql shellVulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). ...6.5 Medium
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.0 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...9.6 Critical
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...9.3 Critical
- wp engine migrate liteWordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability4.7 Medium
- @remix-run server-runtime, @tanstack react-router +1 moreReact Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass3.1 Low
- juice-shop multi-juicerMultiJuicer: Login CSRF allows attacker to force victims into their team4.3 Medium
- henrikmelin more fieldsWordPress More Fields Plugin 2.1 Cross-Site Request Forgery6.9 Medium
- leethompson lazy content slider pluginWordPress Lazy Content Slider Plugin 3.4 CSRF5.3 Medium
- codepeople cp pollsWordPress CP Polls 1.0.8 Cross-Site Request Forgery5.3 Medium
- mispMISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default7.1 High
- phpbbImproper state verification in the OAuth implementation could allow an attacker to manipulate the...8.0 High
- wedevs woocommerce conversion trackingWordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability4.3 Medium
- yith woocommerce product slider carouselWordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)4.6 Medium
- magepeople inc. wpeventlyWordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- yoast duplicate postYoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice5.1 Medium
- bplugins easy twitter feedsEasy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action5.1 Medium
- nezhahq nezhaNezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents7.1 High
- qnap notification centerNotification Center5.1 Medium
- yuluma fastpicker, an order picker and order management system (oms) for woocommerce on steroidsFastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save4.3 Medium
- weaverlancegmailcom jquery hover footnotesjQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- rahulbhangale wp emoticon ratingWP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter6.1 Medium
- rahulbhangale wpmobiWpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action4.3 Medium
- tierrainnovation ajax report commentsAJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update4.3 Medium
- rahulbhangale wp-ultimate-mapWP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter6.1 Medium
- jasonpitts wp meta sort postsWP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- No product listedSemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin...6.3 Medium
- juev nebula-meshnebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints6.9 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action4.3 Medium
- absikandar frontend user notesFrontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action4.3 Medium
- google chromeInappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote...7.5 High
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- Show moreLoading…