CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- locustio locustLocust through 2.46.7 CSRF via Web UI /stop and /stats/reset5.3 Medium
- @fastify/oauth2@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback4.2 Medium
- apache software foundation camelApache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow6.1 Medium
- aircheng-org iwebshop-5aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery5.3 Medium
- No product listedSlims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF...8.8 High
- giteaGitea cross-site request forgery on repository topics8.1 High
- giteaGitea OpenID account linking without session binding5.4 Medium
- dyad-sh dyaddyad-sh dyad OAuth Callback cross-site request forgery5.3 Medium
- gitify-app gitifyGitify before 7.10.0 Login CSRF via Missing OAuth State Validation2.3 Low
- thorsten phpmyfaqphpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database7.1 High
- thorsten phpmyfaqphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations7.1 High
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF6.5 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()4.3 Medium
- tinyhumansai openhumanOpenHuman /auth/telegram CSRF allows attacker-controlled session implantation8.1 High
- athemeart theme helperWordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Administrator Account Creation via CSRF8.8 High
- python-social-auth social-corePython Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)6.5 Medium
- No product listedXXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in...8.8 High
- authtake technology inc. authtakeActive Directory Password Change CSRF in AuthTake Technology's authtake6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- error311 fileriseFileRise: Missing CSRF enforcement for file creation and share-link creation4.3 Medium
- 0xjacky nginx-uiNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)7.1 High
- mher flowerFlower before 2.2.0 CSRF via Worker and Task Control API Endpoints6.0 Medium
- c4illin convertxConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction8.1 High
- patreon wordpressWordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability8.1 High
- patreon wordpressWordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability7.4 High
- netcore nr268Netcore NR268 CGI Endpoint cross-site request forgery5.3 Medium
- progress software corporation marklogic serverCross-site request forgery in Progress MarkLogic Server Query Console7.5 High
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Administrative Actions4.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Import/Export Admin console5.4 Medium
- nicdark hotel bookingHotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF4.3 Medium
- yangzongzhuan ruoyiyangzongzhuan RuoYi cross-site request forgery5.3 Medium
- traccarTraccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback2.3 Low
- openrefineOpenRefine through 3.10.1 CSRF to RCE via get-rows Command7.7 High
- contaoContao: Cross-site request forgery in custom backend actions3.5 Low
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI AuthRequired token cookie fallback enables CSRF against management APIs8.8 High
- mightyminnow dashboard notesWordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- audrasjb gdpr data request formGDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF4.3 Medium
- fifu.app featured image from urlWordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- banq jivejdonJivejdon through 5.0 CSRF via GET-based Account and Thread Actions5.3 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access4.3 Medium
- cisa malcolmCross-Site Request Forgery in Malcolm7.1 High
- pydantic pydantic-ai, pydantic-ai-slim, ai +2 more`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution7.6 High
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.08.7 High
- melapress wp 2faWordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- liquid web / stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability7.1 High
- unknown database addon for wpforms ( wpforms entries )Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF4.3 Medium
- drupal advanced filesystemAdvanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-2175.3 Medium
- wger-project wgerwger: trainer_login accepts GET - CSRF bypass enables forced session rebinding5.4 Medium
- Show moreLoading…