VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,622)

page 260 of 482
  • CVE-2022-46688MedDec 12, 2022
    Jenkins Project
    Sonar Gerrit
    risk 0.35cvss 6.5epss 0.00

    A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through…

  • CVE-2022-45824MedDec 5, 2022
    WordPress
    Advanced Booking Calendar
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

  • CVE-2022-4220MedDec 2, 2022
    WordPress
    Chained Quiz
    risk 0.35cvss 5.4epss 0.00

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from…

  • CVE-2022-4219MedDec 2, 2022
    WordPress
    Chained Quiz
    risk 0.35cvss 5.4epss 0.00

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submitted quiz responses…

  • CVE-2022-4218MedDec 2, 2022
    WordPress
    Chained Quiz
    risk 0.35cvss 5.4epss 0.00

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete quizzes and copy…

  • CVE-2022-26366MedNov 30, 2022
    WordPress
    AdRotate Banner Manager
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.

  • CVE-2022-45073MedNov 18, 2022
    WordPress
    REST API Authentication
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

  • CVE-2022-44740MedNov 18, 2022
    WordPress
    Creative Mail
    risk 0.35cvss 5.4epss 0.00

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

  • CVE-2022-41685MedNov 18, 2022
    WordPress
    Integration for Szamlazz.hu & WooCommerce
    risk 0.35cvss 5.4epss 0.00

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

  • CVE-2022-41634MedNov 18, 2022
    WordPress
    Media Library Folders
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

  • CVE-2022-40695MedNov 18, 2022
    WordPress
    SEO Redirection Plugin
    risk 0.35cvss 5.4epss 0.00

    Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

  • CVE-2022-41805MedNov 18, 2022
    Booster
    Booster For Woocommerce
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

  • CVE-2022-40687MedNov 18, 2022
    WordPress
    Creative Mail
    risk 0.35cvss 5.4epss 0.01

    Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

  • CVE-2022-40686MedNov 18, 2022
    WordPress
    Creative Mail
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

  • CVE-2022-45071MedNov 17, 2022
    Wpml
    Wpml
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

  • CVE-2022-43488MedNov 9, 2022
    WordPress
    Advanced Dynamic Pricing For Woocommerce
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.

  • CVE-2022-43491MedNov 8, 2022
    WordPress
    Advanced Dynamic Pricing For Woocommerce
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

  • CVE-2022-43481MedNov 8, 2022
    WordPress
    Advanced Coupons for WooCommerce
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

  • CVE-2022-40632MedNov 8, 2022
    Gvectors
    Wpforo Forum
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

  • CVE-2022-32587MedNov 8, 2022
    Codeandmore
    Wp Page Widget
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.