CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedThe request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin...8.8 High
- No product listedThe request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin...8.8 High
- google chromeCross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39...5.4 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System cross-site request forgery5.3 Medium
- laurent22 joplinJoplin Web Clipper pairing allows cross-origin theft of a permanent API token8.0 High
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.05.3 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.05.1 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- chatermChaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback6.0 Medium
- unknown cocartCoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass8.8 High
- webriti wallstreetWordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- yeswikiYesWiki before 4.6.7 CSRF Tag Deletion via admintag Action5.3 Medium
- yeswikiYesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler5.3 Medium
- yeswikiYesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler5.3 Medium
- yeswikiYesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler7.2 High
- yeswikiYesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction7.1 High
- getsimplecms-ceGetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request9.6 Critical
- getsimplecms-ceGetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction9.1 Critical
- lektorLektor 3.3.14 CSRF via Admin API Endpoints7.0 High
- memberful - membership pluginWordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability8.0 High
- apache software foundation apisixApache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin2.1 Low
- tryghost ghostGhost 5.19.0 before 6.57.1 Cross-Site Request Forgery5.3 Medium
- pandora fms fmsCSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager7.5 High
- pandora fms fmsCSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager7.4 High
- pandora fms fmsCSRF in Alert Command Deletion5.9 Medium
- pandora fms fmsCSRF in Event Response Deletion5.9 Medium
- marceljm featured image from url (fifu), unknown featured image from url (fifu) premium +1 moreFeatured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF8.8 High
- supsystic photo gallery by supsysticWordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- knitpay razorpay payment links for woocommerceWordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- yoohw studio blacklist manager – woocommerce anti-fraud, blacklist & checkout verificationWordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross...6.5 Medium
- opensolution quick.cartCross-Site Request Forgery in admin panel of Quick.Cart6.9 Medium
- No product listedbasecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site...8.8 High
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion5.3 Medium
- apache software foundation rollerApache Roller: CSRF protection bypass via self-generated salt validation8.1 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project cross-site request forgery5.3 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.06.9 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.05.1 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.05.1 Medium
- froxlorfroxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF7.1 High
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF8.8 High
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager5.3 Medium
- google chromeCross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote...8.8 High
- horilla horilla-hrHorilla attendance approval endpoint is vulnerable to cross-site request forgery5.9 Medium
- zammadZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute6.3 Medium
- zammadZammad: Malicious input in Ticket Body Enables Session Termination5.3 Medium
- invoiceplaneInvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints6.5 Medium
- invoiceplaneInvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection6.5 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- cyber-iii student-management-systemningzichun student-management-system cross-site request forgery5.3 Medium
- Show moreLoading…