VYPR

CWE-352

Cross-Site Request Forgery (CSRF)

CompoundStableLikelihood: Medium

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62

CVEs mapped to this weakness (9,651)

page 32 of 483
  • CVE-2023-48912HigNov 30, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

  • CVE-2023-49673HigNov 29, 2023
    Jenkins Project
    Neuvector Vulnerability Scanner
    risk 0.57cvss 8.8epss 0.00

    A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

  • CVE-2023-49655HigNov 29, 2023
    Jenkins Project
    Matlab
    risk 0.57cvss 8.8epss 0.00

    A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.

  • CVE-2023-47781HigNov 22, 2023
    Thrive Themes
    Thrive Theme Builder
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions.

  • CVE-2023-2497HigNov 22, 2023
    WordPress
    Userpro
    risk 0.57cvss 8.8epss 0.00

    The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP…

  • CVE-2023-2440HigNov 22, 2023
    WordPress
    Userpro
    risk 0.57cvss 8.8epss 0.00

    The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for…

  • CVE-2023-4824HigNov 20, 2023
    Bdaia
    Woohoo Newspaper Magazine Theme
    risk 0.57cvss 8.8epss 0.00

    The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  • CVE-2023-38885HigNov 20, 2023
    openSIS
    openSIS Community Edition
    risk 0.57cvss 8.8epss 0.00

    OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.

  • CVE-2023-6196HigNov 20, 2023
    WordPress
    Audio Merchant
    risk 0.57cvss 8.8epss 0.00

    The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audio_merchant_add_audio_file function. This makes it possible for…

  • CVE-2023-48017HigNov 18, 2023
    Moonsabc123
    dreamer_cms
    risk 0.57cvss 8.8epss 0.00

    Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.

  • CVE-2023-43275HigNov 16, 2023
    Dedecms
    Dedecms
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.

  • CVE-2023-48021HigNov 14, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.

  • CVE-2023-48020HigNov 14, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.

  • CVE-2023-48060HigNov 13, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add

  • CVE-2023-48058HigNov 13, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run

  • CVE-2023-35041HigNov 13, 2023
    webpushr
    Web Push Notifications
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr plugin <= 4.34.0 versions.

  • CVE-2023-26516HigNov 13, 2023
    Wpindeed
    Debug Assistant
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.

  • CVE-2023-42323HigOct 30, 2023
    DouHaocms
    DouHaocms
    risk 0.57cvss 8.8epss 0.00

    Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.

  • CVE-2023-46375HigOct 27, 2023
    Zentao
    Biz
    risk 0.57cvss 8.8epss 0.00

    ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).

  • CVE-2023-45317HigOct 26, 2023
    Sielcosistemi
    Analog Fm Transmitter Exc5000gx Firmware
    risk 0.57cvss 8.8epss 0.00

    The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web …