VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (5,713)

page 132 of 286
  • CVE-2023-46614MedNov 9, 2023
    Matbao
    Wp Helper Premium
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.

  • CVE-2023-34002MedNov 9, 2023
    Wpinventory
    Wp Inventory Manager
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.

  • CVE-2023-31087MedNov 9, 2023
    Joomsky
    Js Job Manager
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.

  • CVE-2023-25975MedNov 9, 2023
    Etsy Shop Project
    Etsy Shop
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.

  • CVE-2023-45884MedNov 9, 2023
    risk 0.35cvss 6.5epss 0.00

    Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

  • CVE-2023-25994MedNov 9, 2023
    Publish To Schedule Project
    Publish To Schedule
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions.

  • CVE-2023-45857MedNov 8, 2023
    Axios
    Axios
    risk 0.35cvss 6.5epss 0.01

    An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

  • CVE-2023-32966MedNov 7, 2023
    Crudlab
    Jazz Popups
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.

  • CVE-2023-46779MedNov 6, 2023
    Easyrecipe Project
    Easyrecipe
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.

  • CVE-2023-46777MedNov 6, 2023
    WordPress
    Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.

  • CVE-2023-45048MedOct 12, 2023
    Repuso
    Repuso
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.

  • CVE-2023-29235MedOct 6, 2023
    Fugu
    Maintenance Switch
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.

  • CVE-2023-2279MedAug 31, 2023
    WordPress
    Wp Directory Kit
    risk 0.35cvss 5.4epss 0.00

    The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-4455MedAug 21, 2023
    Walla Telesite
    Wallabag/wallabag
    risk 0.35cvss 6.5epss 0.00

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

  • CVE-2023-38512MedJul 27, 2023
    Wpstream
    Wpstream
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through <= 4.5.4.

  • CVE-2023-37955MedJul 12, 2023
    Jenkins Project
    Jenkins Test Results Aggregator Plugin
    risk 0.35cvss 6.5epss 0.00

    A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

  • CVE-2023-3011MedJul 12, 2023
    WordPress
    ARMember
    risk 0.35cvss 6.5epss 0.00

    The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform…

  • CVE-2023-3427MedJun 28, 2023
    WordPress
    Salon Booking System
    risk 0.35cvss 5.4epss 0.00

    The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change…

  • CVE-2023-2892MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.35cvss 6.5epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_delete_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2891MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.35cvss 6.5epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_delete_product function. This makes it possible for unauthenticated attackers to delete…