CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- python-social-auth social-coresocial-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend4.3 Medium
- sfturing hosp ordersfturing hosp_order CommonUserController.java cross-site request forgery5.3 Medium
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.07.2 High
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.07.2 High
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.05.3 Medium
- publishpress capabilitiesWordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- drupal tawk.to - live chat applicationTawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-1845.4 Medium
- drupal project browserProject Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-1784.2 Medium
- redaxo, opnsense core +1 moreREDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates6.4 Medium
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)7.1 High
- mispMISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules6.9 Medium
- No product listedCMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a...8.8 High
- jgraph drawiodraw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection4.2 Medium
- hatchet-dev hatchethatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState7.1 High
- mispMISP CSRF vulnerability allows unauthorized attribute modification7.1 High
- fetch designs sign-up sheetsSign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF4.3 Medium
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin5.3 Medium
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler5.3 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent10.0 Critical
- gedelumbung hospitalmanagementgedelumbung HospitalManagement cross-site request forgery5.3 Medium
- batiste django-page-cmsdjango-page-cms through 2.0.13 CSRF via admin mutation views8.4 High
- cubecart v6CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php5.3 Medium
- murtaza-nasir speakrSpeakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook7.1 High
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request...5.4 Medium
- xagio seo seoWordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- publishpress seriesWordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- gabe livan asset cleanup: page speed boosterWordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- unknown active woot products tables for woocommerce. 100% freeActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment4.3 Medium
- wwbn avideoAVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass7.1 High
- phplistphpList before 3.6.17 Cross-Site Request Forgery via massremove.php7.2 High
- yahoo cmakCMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter7.2 High
- djust-org djustdjust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session8.1 High
- No product listedPbootCMS User Management UserController.php mod cross-site request forgery5.3 Medium
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the...8.6 High
- wnc t-mobile 5g box iduCSRF token bypass in T-Mobile 5G Box IDU routers8.4 High
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF6.5 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints7.0 High
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...7.6 High
- oracle corporation sales onlineVulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal...7.6 High
- concrete cms cms, concretecms concrete cms +1 moreIDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation2.1 Low
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.77.1 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint2.3 Low
- concrete cms cmsConcrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control7.7 High
- mispMISP: State-changing actions accessible via GET request enabling CSRF5.3 Medium
- mispMISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent6.9 Medium
- Show moreLoading…