CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- elementor activity logWordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- unknown jetstylemanager for gutenbergJetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF4.3 Medium
- unknown wc vendorsWC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF4.3 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreLack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX8.3 High
- arubanetworks fabric composerUnauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer7.4 High
- tmt machine industry and trade ltd. co. talassoft industrial management softwareCSRF in TMT Machine's Talassoft Industrial Management Software7.1 High
- wwbn avideoAVideo Cross-Site Request Forgery via plugin/API/set.json.php7.2 High
- ellite wallosWallos: OIDC state parameter never validated — login CSRF / account takeover7.5 High
- studio-42 elfinderelFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections5.4 Medium
- honojs @hono/oauth-providers@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking5.4 Medium
- apache wicketApache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener4.6 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via sendEmail.json.php5.3 Medium
- wger-project wgerwger-project wger Password Reset gym.py reset_user_password cross-site request forgery5.3 Medium
- jeremyevans rodauthRodauth before 2.47.0 CSRF Protection Bypass via Content-Type4.9 Medium
- tribulant software newslettersNewsletters < 4.17 - Arbitrary Plugin Option Update via CSRF5.4 Medium
- wwbn avideoWWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php5.1 Medium
- adobe dimensionDimension CSRF Vulnerability in Administrator Passphrase Change Endpoint8.4 High
- ebyte na111-m firmwareEbyte NA111-M Cross-Site Request Forgery8.6 High
- frontaccountingFrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms7.1 High
- wp manage ninja fluentbooking proWordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus < 1.26.7 - Backup Restoration via CSRF5.9 Medium
- nagios enterprises xi, nagios enterprises, llc. core, open source nagios core +2 moreNagios Core / XI CSRF via cmd.cgi Double-Submit Cookie6.9 Medium
- nagios enterprises, llc. core, open source nagios core +1 moreNagios Core CSRF via cmd.cgi6.9 Medium
limeUbuntuCross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12...8.8 High- mervinpraison praisonaiPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server7.6 High
- hashthemes hash formWordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wp manageninja llc fluent support proWordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php7.1 High
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via videoEditLight.php6.9 Medium
- wwbn avideoAVideo channelToGallery.json.php Cross-Site Request Forgery5.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.56.9 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.55.3 Medium
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.664.6 Medium
- unknown litextensionLitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF4.2 Medium
- sourcecodester dynamic input field generator using html, css, and phpSourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery5.3 Medium
- wintercms winterWinter CMS: CSRF through AJAX handler names reachable as backend page actions6.1 Medium
- elated-themes frappeFrappe: Improper Authorization in OAuth2 Consent Endpoint8.5 High
- elated-themes frappeFrappe: Unauthenticated Workflow approval via confirm_action6.9 Medium
- atutorCross-Site Request Forgery (CSRF) in ATutor5.1 Medium
- hashthemes easy elementor addonsWordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.656.9 Medium
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers8.6 High
- tinacmsTina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root6.5 Medium
- splunk, splunk enterprise +1 moreSPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise6.4 Medium
- ibm power systems firmware, power system e1080 \(9080-hex\) firmware, power system e1180 \(9080-heu\) firmware +7 more +9 morePower System Cross-Site Request Forgery (CSRF)8.3 High
- getgrav grav-plugin-loginCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)5.4 Medium
- open-emr openemrOpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter5.3 Medium
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.34.6 Medium
- Show moreLoading…