CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2...8.8 High
- devitems hashbar – wordpress notification barWordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...5.4 Medium
- froxlorFroxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection6.5 Medium
- mobsf mobile-security-framework-mobsfMobSF: CSRF checks not enforced after Django migration6.5 Medium
- mybbMyBB: ACP Recovery Codes CSRF4.6 Medium
- mybbMyBB: ACP UTF-8 Conversion CSRF4.6 Medium
- mybbMyBB: ACP Questions state CSRF3.5 Low
- mybbMyBB: ACP Users View Manager default CSRF3.5 Low
- mybbMyBB: ACP Mass Mail draft resend CSRF3.5 Low
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability7.4 High
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System cross-site request forgery5.3 Medium
- No product listedCross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the...9.3 Critical
- gitlabCross-Site Request Forgery (CSRF) in GitLab7.1 High
- siyuan-note siyuanSiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth2.3 Low
- siyuan-note siyuanSiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy7.1 High
- aresit wp compress – instant performance & speed optimizationWP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion6.5 Medium
- unknown manual image cropManual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR5.7 Medium
- @fastify/oauth2, fastify fastify\/oauth2 +1 more@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies4.2 Medium
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.115.3 Medium
- emlogEmlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover6.8 Medium
- kunbus pictoryCross-Site Request Forgery (CSRF) in KUNBUS PiCtory5.1 Medium
- alian astro booking engineAstro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- francoisjacquet rosariosisfrancoisjacquet RosarioSIS Modules.php cross-site request forgery5.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager8.1 High
- ibm planning analytics, planning analytics local +1 moreIBM Planning Analytics Local is affected by security vulnerabilities7.1 High
- elastic kibanaCross-Site Request Forgery in Kibana Leading to Privilege Escalation7.3 High
- phplist phplist3phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php7.2 High
- phplist phplist3phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules5.3 Medium
- zimbra collaboration, synacor zimbra collaboration suite +1 moreIn Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability...3.1 Low
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.7 Low
- unknown shopengine elementor woocommerce builder addonShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication5.4 Medium
- No product listedbasecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF...5.4 Medium
- nagios enterprises xi, nagios enterprises, llc. core, open source nagios core +2 moreNagios Core / XI CSRF Protection Bypass via Double-Submit Cookie6.1 Medium
- semaphoreui semaphoreSemaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation8.3 High
- davila7 claude-code-templatesClaude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)8.8 High
- misp cti-transmutecti-transmute CSRF Allows Unauthorized Follow and Notification State Changes5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Backend and Install Tool7.3 High
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)4.3 Medium
- ping identity pingfederatePingFederate Administrative Console CSRF weaknesses4.9 Medium
- freepbx frameworkFreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher8.8 High
- wp umbrella umbrellaWordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- pluginsware advanced classifieds & directory proAdvanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure5.3 Medium
- solacewp solace extraSolace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status4.3 Medium
- openyakOpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution9.6 Critical
- unknown estatik real estate pluginEstatik < 4.3.3 - Login CSRF7.5 High
- vladimir garagulya plugins garbage collector (database cleanup)WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- jeff farthing theme my loginWordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- data443 risk mitigation, inc. tracking code managerWordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability7.1 High
- hubzillaHubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration5.1 Medium
- Show moreLoading…