CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup7.1 High
- ibm db2 mirror for iIBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []5.4 Medium
- mispMISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints5.1 Medium
- contec co., ltd. ece1000, ece1020, ecs1020 +30 more +32 moreCross-site request forgery vulnerability exists in multiple Contec products. If a user views a...5.1 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system process.php cross-site request forgery5.3 Medium
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF4.3 Medium
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF6.5 Medium
- unknown gpx2graphicsGpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF7.2 High
- t-mart mouseholeMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state6.9 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records6.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature5.7 Medium
- google site kit by googleWordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- rometheme rtmkitWordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via playlistRemove.php7.1 High
- wwbn avideoAVideo Open Redirect via playlistSort.php Referer Header5.1 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software7.1 High
- concrete cms cmsConcrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller5.3 Medium
- santifer career-opscareer-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution5.8 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via logArchive.json.php7.1 High
- wwbn avideoAVideo CustomizeUser setPassword.json.php CSRF7.1 High
- wwbn avideoWWBN AVideo CustomizeUser setSubscribers CSRF via GET5.3 Medium
- wwbn avideoWWBN AVideo LoginControl PGP Key CSRF via GET Request7.1 High
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.47.1 High
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.46.9 Medium
- google chromeCross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010...4.3 Medium
- netgear xr1000 firmware, xr1000v2, xr1000v2 firmware +2 more +4 moreA CSRF vulnerability exists in certain NETGEAR XR series devices1.8 Low
- wwbn avideoAVideo YPTWallet saveBalance.php Cross-Site Request Forgery7.1 High
- wwbn avideoWWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking5.3 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php7.1 High
- adobe dimensionDimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service7.0 High
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreCross-site request forgery in the Guardian/CMC login before 26.3.05.1 Medium
- sap se s/4hana (finance for advanced payment management)Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)3.5 Low
- sap se s/4hana (finance for advanced payment management)Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)3.5 Low
- sap se s/4hana (finance for advanced payment management)Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)4.6 Medium
- light0011 cmslight0011 cms cross-site request forgery5.3 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery5.3 Medium
- diem-project diemdiem-project diem dmConsole actions.class.php executeCommand cross-site request forgery5.3 Medium
- tycon systems tpdin-monitor-web3Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery8.6 High
- roskus prospero flow crmCSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes5.1 Medium
- mispCross-Site Request Forgery via Attacker-Controlled REST Detection in MISP6.2 Medium
- mispMISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests8.6 High
- mispMISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request8.8 High
- wwbn avideoAVideo through c91b5975d CSRF via saveLive.php7.1 High
- wwbn avideoAVideo removePoster.php Cross-Site Request Forgery File Deletion5.3 Medium
- jenkins project pipeline: groovy libraries pluginA cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin...5.4 Medium
- jenkins project jenkinsIn Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093...8.8 High
- unknown simple membership mailchimp integrationSimple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF5.4 Medium
- themegoods grand tourWordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- Show moreLoading…