CWE-352 · Cross-Site Request Forgery (CSRF) (page 10)
Page 10 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37149 | High | 8.1 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated us… |
CVE-2020-37145 | Medium | 4.3 | 2026-02-05 | HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registrati… |
CVE-2020-37144 | Medium | 5.3 | 2026-02-05 | Exagate SYSGuard 6001 contains a cross-site request forgery vulnerability that allows attackers to create unauthorized admin accounts through a crafted HTML fo… |
CVE-2020-37118 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interac… |
CVE-2025-68722 | High | 8.8 | 2026-02-05 | Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improp… |
CVE-2024-40685 | Medium | 4.3 | 2026-02-04 | IBM Operations Analytics – Log Analysis versions 1.3.5.0 through 1.3.8.3 and IBM SmartCloud Analytics – Log Analysis are vulnerable to a cross-site request for… |
CVE-2026-1835 | Medium | 4.3 | 2026-02-04 | A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown part. The manipulation leads to cross-… |
CVE-2026-25155 | Medium | 5.9 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of… |
CVE-2026-25151 | Medium | 5.9 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request hea… |
CVE-2020-37096 | Medium | 5.3 | 2026-02-03 | Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft malicious web page… |
CVE-2020-37091 | Medium | 5.3 | 2026-02-03 | Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administrative accounts without authentication… |
CVE-2026-24434 | Medium | 6.5 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior does not implement CSRF protections for administrative functions in the web management interface… |
CVE-2026-24666 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vul… |
CVE-2026-25024 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects Thir… |
CVE-2026-25015 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1… |
CVE-2026-25014 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in themelooks Enter Addons enteraddons allows Cross Site Request Forgery.This issue affects Enter Addons: from… |
CVE-2026-24986 | Medium | 5.4 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forge… |
CVE-2026-24966 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape… |
CVE-2026-24962 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a thro… |
CVE-2026-24942 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: fro… |
CVE-2026-20704 | Medium | 4.3 | 2026-02-03 | Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, u… |
CVE-2026-1447 | Medium | 5.4 | 2026-02-03 | The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce valid… |
CVE-2026-25221 | High | 8.1 | 2026-02-02 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vu… |
CVE-2026-24007 | Medium | 4.6 | 2026-02-02 | Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items… |
CVE-2026-0658 | Medium | 4.3 | 2026-02-02 | The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged… |
CVE-2026-1745 | Medium | 4.3 | 2026-02-02 | A vulnerability was determined in SourceCodester Medical Certificate Generator App 1.0. This affects an unknown part. This manipulation causes cross-site reque… |
CVE-2026-1165 | Medium | 4.3 | 2026-01-31 | The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce imple… |
CVE-2020-37054 | Medium | 4.3 | 2026-01-30 | Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attack… |
CVE-2020-37046 | Medium | 5.3 | 2026-01-30 | Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users thro… |
CVE-2020-37026 | Medium | 5.3 | 2026-01-30 | Sickbeard alpha contains a cross-site request forgery vulnerability that allows attackers to disable authentication by submitting crafted configuration paramet… |
CVE-2025-15550 | Medium | 5.3 | 2026-01-29 | birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query reque… |
CVE-2020-37007 | Medium | 5.3 | 2026-01-29 | Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Atta… |
CVE-2025-14472 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0… |
CVE-2025-13982 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f… |
CVE-2025-14795 | Medium | 4.3 | 2026-01-28 | The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing… |
CVE-2026-1398 | Medium | 4.3 | 2026-01-28 | The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorre… |
CVE-2026-1380 | Medium | 4.3 | 2026-01-28 | The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or… |
CVE-2026-1377 | Medium | 4.3 | 2026-01-28 | The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation… |
CVE-2025-59901 | | 2026-01-28 | Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of… | |
CVE-2025-59894 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59893 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59892 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59891 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-14616 | Medium | 4.3 | 2026-01-28 | The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is… |
CVE-2026-0818 | Medium | 4.3 | 2026-01-28 | When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled… |
CVE-2026-24345 | High | 8.8 | 2026-01-27 | Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI |
CVE-2026-24408 | Unrated | | 2026-01-26 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is sus… |
CVE-2026-24432 | Medium | 4.3 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints… |
CVE-2026-1208 | Medium | 4.3 | 2026-01-24 | The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to… |
CVE-2025-14907 | Medium | 4.3 | 2026-01-24 | The Moderate Selected Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing… |
CVE-2025-14630 | Medium | 4.3 | 2026-01-24 | The AdminQuickbar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.3. This is due to missing or incor… |
CVE-2025-13205 | Medium | 4.3 | 2026-01-24 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site R… |
CVE-2025-13194 | Medium | 4.3 | 2026-01-24 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site R… |
CVE-2025-13139 | Medium | 4.3 | 2026-01-24 | The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2… |
CVE-2026-1088 | Medium | 4.3 | 2026-01-24 | The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce… |
CVE-2026-1081 | Medium | 4.3 | 2026-01-24 | The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing… |
CVE-2026-1076 | Medium | 4.3 | 2026-01-24 | The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing no… |
CVE-2026-1075 | Medium | 4.3 | 2026-01-24 | The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce vali… |
CVE-2026-1070 | Medium | 4.3 | 2026-01-24 | The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce… |
CVE-2025-14906 | Medium | 4.3 | 2026-01-24 | The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing… |
CVE-2025-14903 | Medium | 4.3 | 2026-01-24 | The Simple Crypto Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2. This is due to missing n… |
CVE-2026-24596 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request F… |
CVE-2026-24549 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a… |
CVE-2026-24542 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term O… |
CVE-2026-24521 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbna… |
CVE-2026-24384 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue… |
CVE-2026-24374 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Reque… |
CVE-2026-24365 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This iss… |
CVE-2026-22483 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a thro… |
CVE-2026-22462 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Reque… |
CVE-2026-22382 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forg… |
CVE-2026-22360 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a thro… |
CVE-2026-22359 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects… |
CVE-2026-22355 | High | 7.1 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: fr… |
CVE-2025-70899 | Medium | 6.5 | 2026-01-22 | PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized… |
CVE-2025-67626 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search… |
CVE-2025-31413 | Medium | 4.3 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This iss… |
CVE-2021-47860 | Medium | 5.3 | 2026-01-21 | GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side co… |
CVE-2021-47830 | Medium | 6.5 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visit… |
CVE-2025-36411 | Low | 3.5 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2026-1051 | Medium | 4.3 | 2026-01-20 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1… |
CVE-2026-23950 | High | 8.8 | 2026-01-20 | node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path col… |
CVE-2026-1169 | Medium | 4.3 | 2026-01-19 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site r… |
CVE-2026-1153 | Medium | 4.3 | 2026-01-19 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request for… |
CVE-2026-1148 | Medium | 4.3 | 2026-01-19 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Exec… |
CVE-2026-1142 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site… |
CVE-2021-47820 | Medium | 5.3 | 2026-01-16 | Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a m… |
CVE-2025-14853 | Medium | 4.3 | 2026-01-16 | The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrec… |
CVE-2021-47800 | Medium | 5.3 | 2026-01-16 | b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers c… |
CVE-2026-23622 | High | 8.8 | 2026-01-15 | Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST req… |
CVE-2021-47754 | Medium | 6.5 | 2026-01-15 | Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers ca… |
CVE-2025-15376 | Medium | 4.3 | 2026-01-14 | The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing n… |
CVE-2025-14846 | Medium | 4.3 | 2026-01-14 | The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to mis… |
CVE-2025-15377 | Medium | 4.3 | 2026-01-14 | The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing non… |
CVE-2025-14615 | High | 7.1 | 2026-01-14 | The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2025-14389 | Medium | 4.3 | 2026-01-14 | The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce… |
CVE-2026-0493 | Medium | 4.3 | 2026-01-13 | Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions… |
CVE-2026-22800 | Low | 2.4 | 2026-01-12 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists… |
CVE-2021-41074 | Medium | 5.4 | 2026-01-12 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. |
CVE-2025-14976 | Medium | 5.4 | 2026-01-10 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for Word… |