VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,622)

page 240 of 482
  • CVE-2024-39119MedJul 2, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close.

  • CVE-2024-23737MedJul 1, 2024
    savignano
    S Notify
    risk 0.35cvss 5.4epss 0.00

    Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.

  • CVE-2024-5935MedJun 27, 2024
    Imartinez
    privategpt
    risk 0.35cvss 5.4epss 0.00

    A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.

  • CVE-2024-37118MedJun 21, 2024
    Uncannyowl
    Uncanny Automator
    risk 0.35cvss 5.4epss 0.00

    Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3.

  • CVE-2023-25697MedJun 19, 2024
    Gamipress
    Gamipress
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6.

  • CVE-2024-3965MedJun 14, 2024
    WordPress
    Pray For Me
    risk 0.35cvss 5.4epss 0.00

    The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  • CVE-2024-31613MedJun 10, 2024
    BOSSCMS
    BOSSCMS
    risk 0.35cvss 5.4epss 0.00

    BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."

  • CVE-2024-35657MedJun 8, 2024
    WordPress
    Wp Recall
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6.

  • CVE-2024-35689MedJun 8, 2024
    WordPress
    Analytify
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3.

  • CVE-2024-5003MedJun 7, 2024
    WordPress
    Wp Stacker
    risk 0.35cvss 5.4epss 0.00

    The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

  • CVE-2024-4429MedMay 28, 2024
    Opentext
    iManager
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to sensitive information disclosure.

  • CVE-2023-7045MedMay 23, 2024
    GitLab Inc.
    GitLab
    risk 0.35cvss 5.4epss 0.00

    A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).

  • CVE-2024-35561MedMay 22, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close.

  • CVE-2024-35554MedMay 22, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN.

  • CVE-2024-1446MedMay 22, 2024
    WordPress
    NextScripts: Social Networks Auto-Poster
    risk 0.35cvss 5.4epss 0.00

    The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This is due to missing or incorrect nonce validation on the nxssnap-reposter page. This makes it possible for…

  • CVE-2024-34957MedMay 16, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet.

  • CVE-2024-35011MedMay 14, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.

  • CVE-2024-34816MedMay 14, 2024
    WordPress
    WPCal.Io – Easy Meeting Scheduler
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.

  • CVE-2024-34814MedMay 14, 2024
    Brizy
    Unyson
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Unyson Unyson unyson.This issue affects Unyson: from n/a through <= 2.7.29.

  • CVE-2024-33829MedMay 6, 2024
    idcCMS
    idcCMS
    risk 0.35cvss 5.4epss 0.00

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache.