CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- unknown mailersendMailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF5.4 Medium
- geex-arts django-jetgeex-arts django-jet OAuth cross-site request forgery5.3 Medium
- sipeed picoclawSipeed PicoClaw auth.go cross-site request forgery5.3 Medium
- w3scloud w3sc elementor to zoho crmW3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- joomdonation.com events booking extension for joomlaJoomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.08.8 High
- getgrav gravgrav-plugin-login < 3.8.11 CSRF via regenerate2FASecret2.3 Low
- hcl dfxanalyticsHCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.3.0 Low
- timwhitlock loco translateLoco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter8.8 High
- unknown appointment booking pluginLatePoint < 5.6.3 - Multiple Privileged Actions via CSRF5.4 Medium
- umarbajwa landing page builder – coming soon page, maintenance mode, lead page, wordpress landing pagesLanding Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreSPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise8.3 High
- dani-garcia vaultwardenVaultwarden: CSRF in SSO Authorization Flow8.3 High
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3...9.1 Critical
- sri mojoliciousMojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle9.1 Critical
- dan-in-ca sip, sustainable irrigation platform +1 moreSustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests7.0 High
- kimaiKimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes5.3 Medium
- No product listedCross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows...7.5 High
- kimaiKimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes6.3 Medium
- hedgedocHedgeDoc: CSRF in GitHub Gist export callback6.8 Medium
- rejetto hfsRejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests5.1 Medium
- hamsalam ووسلام – همگام سازی ووکامرس و باسلامWordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- purethemes workscout-coreWordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability8.8 High
- st engineering idirect 3315-series terminals, 9-series terminals, evolution iq‑series terminals +2 moreST Engineering iDirect iQ-Series Terminals Cross-Site request forgery7.0 High
- sovlix goodmeet – google meet integration for webinar, meeting & video conferenceGoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'4.3 Medium
- wordpresschef salon booking system – free versionSalon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter8.8 High
- cotontiCotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint8.7 High
- yeswikiYesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize9.4 Critical
- mockoonMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft8.8 High
- admidioAdmidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests5.2 Medium
- badhonrocks divi torque lite – divi modules for the divi builder & themeDivi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint8.8 High
- hp inc. poly ccx, poly edge e, poly trio c60 +2 morePoly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack6.0 Medium
- wakujs wakuWaku: Cross-Origin CSRF on RSC Server Action Dispatch6.5 Medium
- bishopfox joroJoro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE9.6 Critical
- drupal ray enterprise translationRay Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-0714.3 Medium
- flask-dashboard flask-monitoringdashboardflask-dashboard Flask-MonitoringDashboard cross-site request forgery5.3 Medium
- smub smash balloon social photo feed – easy social feeds pluginSmash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter4.7 Medium
- wpkuf wp js detectWp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
ha-mcpPyPIha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path6.5 Medium- oraios serenaSerena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE8.3 High
- newapi new api, quantumnous new-api +1 moreNew API CSRF in email and WeChat account binding endpoints5.3 Medium
- seiko epson corporation web configCross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a...5.1 Medium
- coollabsio coolifyCoolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value8.0 High
- leantimeLeantime - OIDC Login CSRF via Unconditional State Verification Stub8.6 High
- imhamzaazam ecommerceflaskimhamzaazam ecommerceFlask cross-site request forgery5.3 Medium
- properfraction crawlwp seoWordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- cornelius plack::middleware::oauthPlack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter8.1 High
- biafra dancer2::plugin::auth::oauth::providerDancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter8.1 High
- webpack-dev-serverwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints4.7 Medium
- xplodedthemes wpide – file manager & code editorWordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- blueastralthemes seowpWordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability7.1 High
- Show moreLoading…