VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,622)

page 243 of 482
  • CVE-2023-44999MedMar 27, 2024
    WooCommerce
    Stripe Payment Gateway
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.

  • CVE-2024-1213MedMar 21, 2024
    WordPress
    Easy Social Feed
    risk 0.35cvss 5.4epss 0.00

    The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and…

  • CVE-2024-1785MedMar 20, 2024
    WordPress
    Contests From Rewards Fuel
    risk 0.35cvss 5.4epss 0.00

    The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers…

  • CVE-2023-51487MedMar 16, 2024
    Ari Soft
    Ari Stream Quiz
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32.

  • CVE-2023-51486MedMar 16, 2024
    Rednao
    Woocommerce PDF Invoice Builder
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

  • CVE-2023-51521MedMar 16, 2024
    WordPress
    Quiz and Survey Master (QSM)
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.

  • CVE-2023-51491MedMar 16, 2024
    Depicter
    Depicter
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.

  • CVE-2023-51489MedMar 16, 2024
    Automattic
    Crowdsignal Dashboard
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.

  • CVE-2024-28672MedMar 13, 2024
    Dedecms
    Dedecms
    risk 0.35cvss 5.4epss 0.00

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.

  • CVE-2024-28669MedMar 13, 2024
    Dedecms
    Dedecms
    risk 0.35cvss 5.4epss 0.00

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.

  • CVE-2023-51531MedFeb 29, 2024
    Thrivethemes
    Thrive Automator
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Automator.This issue affects Thrive Automator: from n/a through 1.17.

  • CVE-2024-26450MedFeb 28, 2024
    Piwigo
    Piwigo
    risk 0.35cvss 5.4epss 0.00

    An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing…

  • CVE-2024-27948MedFeb 28, 2024
    Bytesforall
    Atahualpa
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24.

  • CVE-2023-51533MedFeb 28, 2024
    Ecwid Ecommerce
    Ecwid Ecommerce Shopping Cart
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.

  • CVE-2024-21749MedFeb 28, 2024
    Atakanau
    Click Disable All
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1.

  • CVE-2023-52223MedFeb 28, 2024
    Mailerlite
    Mailerlite
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

  • CVE-2023-51683MedFeb 28, 2024
    WordPress
    Easy PayPal & Stripe Buy Now Button
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.

  • CVE-2024-24705MedFeb 28, 2024
    WordPress
    Octa Code Accessibility
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6.

  • CVE-2024-25905MedFeb 21, 2024
    Mondula
    Multi Step Form
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18.

  • CVE-2023-6499MedFeb 12, 2024
    WordPress
    lasTunes
    risk 0.35cvss 5.4epss 0.00

    The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack