CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions5.4 Medium
- unknown google authenticatorGoogle Authenticator < 0.56 - 2FA Secret Overwrite via CSRF6.5 Medium
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR5.3 Medium
- livebookLivebook Teams identity callback lacks state binding, allowing login CSRF6.8 Medium
- jenkins project scm-manager pluginA cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and...4.2 Medium
- jenkins project multijob pluginA cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0...8.8 High
- progress marklogic serverCross-site request forgery in Progress MarkLogic Server Admin UI7.5 High
- openshwprojects openbk7231t appOpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack6.5 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST...8.8 High
- pluck cms cms, pluck-cms pluck cms +1 morePluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE9.6 Critical
- cornelraiu-1 search analytics for wpSearch Analytics for WP <= 1.4.16 - Cross-Site Request Forgery8.1 High
- unknown mlsimport: idx plugin & mls plugin for real estate listingsMLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item4.3 Medium
- unknown gdpr cookie complianceGDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF4.3 Medium
- No product listedRackTables cross-site request forgery5.3 Medium
- erlang ecosystem foundation oidcc plugOidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection2.1 Low
- admidioAdmidio before 5.0.11 CSRF via category-report preferences7.1 High
- misp cti-transmuteCross-Site Request Forgery in the Administrative User Deletion Endpoint8.8 High
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF5.4 Medium
- unknown lenxel wpLenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset8.1 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match8.8 High
- mndpsingh287 theme editorTheme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification4.3 Medium
- eric teubert podlove podcast publisherPodlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF4.3 Medium
- gz scripts car rental script, event booking calendar, property listing script +32 more +34 moreCSRF in PHP Jabbers scripts6.9 Medium
- No product listedPrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery ...8.8 High
- leantimeLeantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware8.6 High
- apache jspwikiApache JSPWiki: JSPWiki vulnerable to JSON hijacking8.8 High
- apache zeppelinApache Zeppelin: Cross-site request forgery in REST and WebSocket request handling6.1 Medium
- softtr information technology trade ltd. co. e-commerce packCSRF in Softtr's E-Commerce Pack8.3 High
- fusewp – wordpress user sync to email list & marketing automation (mailchimp, constant contact, activecampaign etc.)FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle4.3 Medium
- goodlayers tourmasterTourmaster < 5.4.8 - Stored XSS via CSRF7.1 High
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote...6.5 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a cross-site request forgery3.1 Low
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.27.3 High
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.08.8 High
- facturadorvirtual facturación electrónica costa ricaFacturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- realmag777 wolfWOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF7.1 High
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeCookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries4.3 Medium
org.xwiki.contrib:discussions-serverMavenorg.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages6.5 Medium- ht plugins insert headers and footers code – ht scriptWordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- jgwhite33 wp google review sliderWordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- budibase serverBudibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF8.7 High
- @tanstack react-routerReact Router: Unauthenticated Denial of Service via Inefficient Route Matching8.7 High
- wpo365 | seamless wordpress + microsoft integration (wpo365 | login)WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update8.8 High
- mailpoetWordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- metin saraç popup for cf7 with sweet alertWordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- bimal rekhadiya kwayy html sitemapWordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability7.1 High
- mahdi yousefi افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- melapress wp activity log, wp activity log premium +1 moreWordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- avada studio core, themefusion avada core +1 moreWordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- Show moreLoading…