CWE-352
Cross-Site Request Forgery (CSRF)
Description
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-111 · CAPEC-462 · CAPEC-467 · CAPEC-62
CVEs mapped to this weakness (9,580)
page 392 of 479| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-3076 | Low | 0.25 | 3.8 | 0.00 | Apr 26, 2024 | The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||
| CVE-2020-2184 | Med | 0.25 | 4.3 | 0.44 | May 6, 2020 | A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL. | ||
| CVE-2018-13407 | Med | 0.25 | 4.9 | 0.00 | Jul 6, 2018 | A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused. | ||
| CVE-2017-8382 | Med | 0.25 | 4.5 | 0.03 | May 16, 2017 | admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. | ||
| CVE-2025-62318 | Low | 0.24 | 3.7 | 0.00 | Aug 13, 2026 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions. | ||
| CVE-2026-13243 | Med | 0.24 | 4.8 | 0.00 | Jul 10, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3. | ||
| CVE-2026-12002 | Med | 0.24 | 4.7 | 0.00 | Jul 8, 2026 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes… | ||
| CVE-2026-49043 | Med | 0.24 | 4.7 | 0.00 | Jun 15, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions. | ||
| CVE-2024-48341 | Low | 0.24 | 3.7 | 0.00 | Sep 8, 2025 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop | ||
| CVE-2025-58272 | Low | 0.24 | 3.7 | 0.00 | Sep 3, 2025 | Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker, the settings of the product may be unintentionally changed. | ||
| CVE-2025-54529 | Low | 0.24 | 3.7 | 0.00 | Jul 28, 2025 | In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration | ||
| CVE-2025-26211 | Low | 0.24 | 3.7 | 0.00 | May 27, 2025 | Gibbon before 29.0.00 allows CSRF. | ||
| CVE-2024-8120 | Med | 0.24 | 4.7 | 0.00 | Aug 24, 2024 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This… | ||
| CVE-2024-31265 | Low | 0.24 | 3.7 | 0.00 | Apr 12, 2024 | Cross-Site Request Forgery (CSRF) vulnerability in SumoMe Sumo.This issue affects Sumo: from n/a through 1.34. | ||
| CVE-2023-43649 | Med | 0.24 | 4.7 | 0.00 | Oct 30, 2023 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue. | ||
| CVE-2023-2307 | Med | 0.24 | 4.7 | 0.00 | Apr 26, 2023 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0. | ||
| CVE-2022-26309 | Low | 0.24 | 3.7 | 0.00 | Aug 1, 2022 | Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group. | ||
| CVE-2020-35677 | Med | 0.24 | 4.8 | 0.00 | Dec 24, 2020 | BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in… | ||
| CVE-2026-69093 | Med | 0.23 | 4.6 | 0.00 | Aug 3, 2026 | Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a… | ||
| CVE-2026-45317 | Med | 0.23 | 4.6 | 0.00 | May 15, 2026 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a… |
- risk 0.25cvss 3.8epss 0.00
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- risk 0.25cvss 4.3epss 0.44
A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.
- risk 0.25cvss 4.9epss 0.00
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused.
- risk 0.25cvss 4.5epss 0.03
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.
- risk 0.24cvss 3.7epss 0.00
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
- risk 0.24cvss 4.8epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
- risk 0.24cvss 4.7epss 0.00
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes…
- risk 0.24cvss 4.7epss 0.00
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
- risk 0.24cvss 3.7epss 0.00
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop
- risk 0.24cvss 3.7epss 0.00
Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker, the settings of the product may be unintentionally changed.
- risk 0.24cvss 3.7epss 0.00
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
- risk 0.24cvss 3.7epss 0.00
Gibbon before 29.0.00 allows CSRF.
- risk 0.24cvss 4.7epss 0.00
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This…
- risk 0.24cvss 3.7epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in SumoMe Sumo.This issue affects Sumo: from n/a through 1.34.
- risk 0.24cvss 4.7epss 0.00
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- risk 0.24cvss 4.7epss 0.00
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
- risk 0.24cvss 3.7epss 0.00
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
- risk 0.24cvss 4.8epss 0.00
BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in…
- risk 0.23cvss 4.6epss 0.00
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a…
- risk 0.23cvss 4.6epss 0.00
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a…