CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Also known as Session Riding, Cross Site Reference Forgery, XSRF.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- opnsense coreREDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation8.6 High
- opnsense coreREDAXO before 5.21.3 CSRF in Article History Plugin5.1 Medium
- opnsense coreREDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter5.1 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions7.1 High
- phoca.cz phoca download extension for joomlaJoomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.55.3 Medium
- ubiquiti inc airmax mA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site...7.1 High
- ubiquiti inc airmax mA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site...8.8 High
- boneioCross-Site Request Forgery (CSRF) in boneIO5.1 Medium
- webasyst frameworkWebasyst Framework through 4.4.0 Photos App CSRF via Backend Actions7.1 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- yeswikiYesWiki before 4.7.0 CSRF via despam Admin Action7.2 High
- linkstackorg linkstackLinkStackOrg LinkStack cross-site request forgery5.3 Medium
- docile-alligator infinity for redditInfinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity5.3 Medium
- tenda f6Tenda F6 Web Management cross-site request forgery5.3 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreZimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking7.1 High
- asus routerImproper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and...8.6 High
- knime business hubCSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub5.3 Medium
- xpro elementor addonsWordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- obot-platform obotObot before 0.26.0 API Key Theft via CLI Login Token Request8.6 High
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in...3.7 Low
- splunk, splunk enterprise +1 moreFederated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise4.2 Medium
- tailored media toolsWordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- drupal frontend editingFrontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-2404.8 Medium
- electronElectron: SameSite cookie restrictions are not applied to windows opened from links4.2 Medium
- progressive robot ltd hmailserverCross-Site Request Forgery (CSRF) in hMailServer5.3 Medium
- codename065 download managerDownload Manager (Free & Pro) - Privacy Settings Update via CSRF4.3 Medium
- uncanny owl toolkit for learndash, unknown uncanny toolkit for learndash +1 moreUncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF7.5 High
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover8.7 High
- triggerdotdev trigger.devTrigger.dev before 4.5.12 CSRF via Slack OAuth Callback State5.3 Medium
- wwbn avideoWWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints5.1 Medium
- oracle corporation bi publisherVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). ...6.1 Medium
- oracle siebel crm, oracle corporation siebel crm end user +1 moreVulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). ...3.1 Low
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web...3.1 Low
- oracle webcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component:...6.1 Medium
- oracle corporation applications frameworkVulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:...8.7 High
- oracle corporation agile product lifecycle management for processVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle...5.4 Medium
- oracle corporation helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported...6.9 Medium
- oracle purchasingVulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals)....6.1 Medium
- oracle corporation demand planningVulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal...6.1 Medium
- oracle corporation trusted answer searchVulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported...7.6 High
- oracle siebel crm, oracle corporation siebel crm development +1 moreVulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel...8.8 High
- oracle corporation siebel crm integrationVulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open...4.7 Medium
- oracle siebel crm, oracle corporation siebel life sciences +1 moreVulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). ...8.7 High
- oracle corporation siebel crm developmentVulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). ...7.1 High
- oracle siebel crm, oracle corporation siebel apps - marketing +1 moreVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email...6.1 Medium
- oracle siebel crm, oracle corporation siebel apps - marketing +1 moreVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)....4.3 Medium
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- apache software foundation airflow amazon providerApache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account8.8 High
- Show moreLoading…