CWE-352 · Cross-Site Request Forgery (CSRF) (page 11)
Page 11 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64760 | Medium | 4.6 | 2025-12-08 | Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.17631269… |
CVE-2025-64499 | Medium | 4.6 | 2025-12-08 | Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 a… |
CVE-2025-64498 | Medium | 4.6 | 2025-12-08 | Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap… |
CVE-2025-60912 | Low | 3.3 | 2025-12-08 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the… |
CVE-2025-42616 | | 2025-12-08 | Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged action… | |
CVE-2025-14117 | Medium | 4.3 | 2025-12-06 | A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may… |
CVE-2025-13629 | Medium | 4.3 | 2025-12-06 | The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce… |
CVE-2025-66629 | Low | 3.7 | 2025-12-05 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login provide… |
CVE-2025-12879 | High | 8.8 | 2025-12-05 | The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing… |
CVE-2025-13684 | Medium | 4.3 | 2025-12-05 | The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on… |
CVE-2025-12130 | Medium | 4.3 | 2025-12-05 | The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers… |
CVE-2025-12373 | Medium | 4.3 | 2025-12-05 | The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2025-13621 | Medium | 6.1 | 2025-12-05 | The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorre… |
CVE-2025-13360 | Medium | 4.3 | 2025-12-05 | The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to mis… |
CVE-2025-13144 | Medium | 4.3 | 2025-12-05 | The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insuf… |
CVE-2025-12190 | Medium | 4.3 | 2025-12-05 | The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to miss… |
CVE-2025-12189 | Medium | 4.3 | 2025-12-05 | The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request F… |
CVE-2025-12128 | Medium | 4.3 | 2025-12-05 | The Hide Categories Or Products On Shop Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7. This… |
CVE-2025-10055 | Medium | 4.3 | 2025-12-05 | The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorre… |
CVE-2025-13362 | Medium | 4.3 | 2025-12-05 | The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validat… |
CVE-2025-11759 | Medium | 4.3 | 2025-12-05 | The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2024-45538 | Critical | 9.6 | 2025-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Uni… |
CVE-2025-65027 | High | 7.6 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestric… |
CVE-2025-12358 | Medium | 4.3 | 2025-12-03 | The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5… |
CVE-2025-13871 | High | 8.8 | 2025-12-02 | Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connecte… |
CVE-2025-13685 | Medium | 4.3 | 2025-12-02 | The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing n… |
CVE-2025-13140 | Medium | 4.3 | 2025-12-02 | The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20… |
CVE-2025-13606 | Medium | 6.5 | 2025-12-02 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-65840 | High | 8.8 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. |
CVE-2024-53684 | High | 7.5 | 2025-12-01 | A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request… |
CVE-2025-13296 | Medium | 5.4 | 2025-12-01 | Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce allows Cross Site Request Forgery. This issue affects T-Soft E-Com… |
CVE-2025-13790 | Medium | 4.3 | 2025-11-30 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack ma… |
CVE-2025-53897 | Medium | 6.8 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to lo… |
CVE-2025-51733 | Medium | 5.5 | 2025-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-13737 | Medium | 4.3 | 2025-11-28 | The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is du… |
CVE-2025-13143 | Medium | 4.3 | 2025-11-27 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19… |
CVE-2025-12578 | Medium | 4.3 | 2025-11-27 | The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or inco… |
CVE-2025-62593 | High | 8.8 | 2025-11-26 | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability explo… |
CVE-2025-12061 | High | 8.6 | 2025-11-26 | The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import… |
CVE-2025-60739 | Critical | 9.6 | 2025-11-25 | Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a r… |
CVE-2025-12587 | Medium | 4.3 | 2025-11-25 | The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce valid… |
CVE-2025-12586 | Medium | 4.3 | 2025-11-25 | The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. Th… |
CVE-2025-62497 | Medium | 6.5 | 2025-11-25 | Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unin… |
CVE-2025-56400 | High | 8.8 | 2025-11-24 | Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mob… |
CVE-2025-63953 | Medium | 6.5 | 2025-11-24 | A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts vi… |
CVE-2025-63952 | Medium | 5.7 | 2025-11-24 | A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts vi… |
CVE-2025-65107 | Medium | 6.5 | 2025-11-21 | Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provi… |
CVE-2025-11087 | High | 8.8 | 2025-11-21 | The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due t… |
CVE-2025-66097 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Term… |
CVE-2025-66064 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue a… |
CVE-2025-66061 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This… |
CVE-2025-13142 | Medium | 4.3 | 2025-11-21 | The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce v… |
CVE-2025-13134 | Medium | 6.1 | 2025-11-21 | The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect… |
CVE-2025-62687 | Medium | 6.5 | 2025-11-21 | Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed. |
CVE-2025-62346 | Medium | 6.8 | 2025-11-20 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malic… |
CVE-2025-12535 | Medium | 5.3 | 2025-11-19 | The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin d… |
CVE-2025-63955 | High | 7.5 | 2025-11-18 | A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an… |
CVE-2025-59114 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-59112 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the vi… |
CVE-2025-59110 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token… |
CVE-2025-6670 | High | 8.8 | 2025-11-18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within a… |
CVE-2025-9625 | Medium | 4.3 | 2025-11-18 | The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing… |
CVE-2025-12827 | Medium | 4.3 | 2025-11-18 | The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce valida… |
CVE-2025-12406 | Medium | 6.1 | 2025-11-18 | The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to mi… |
CVE-2025-12404 | Medium | 6.1 | 2025-11-18 | The Like-it plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect non… |
CVE-2025-12173 | Medium | 4.3 | 2025-11-18 | The WP Admin Microblog plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or… |
CVE-2025-55057 | Medium | 4.5 | 2025-11-17 | Multiple CWE-352 Cross-Site Request Forgery (CSRF) |
CVE-2025-13283 | High | 7.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provi… |
CVE-2025-13282 | High | 8.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs… |
CVE-2025-13179 | Medium | 4.3 | 2025-11-14 | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown… |
CVE-2025-13177 | Medium | 4.3 | 2025-11-14 | A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery… |
CVE-2025-59480 | Medium | 6.1 | 2025-11-13 | Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instanc… |
CVE-2025-13119 | Medium | 4.3 | 2025-11-13 | A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forge… |
CVE-2025-64271 | Medium | 4.3 | 2025-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin… |
CVE-2025-64262 | Medium | 6.5 | 2025-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in ramon fincken Auto Prune Posts auto-prune-posts allows Cross Site Request Forgery.This issue affects Auto Pr… |
CVE-2025-64482 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347… |
CVE-2025-64117 | Medium | 4.6 | 2025-11-12 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675… |
CVE-2025-57310 | High | 8.8 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to e… |
CVE-2025-60645 | Medium | 6.5 | 2025-11-12 | A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request. |
CVE-2025-12901 | Medium | 4.3 | 2025-11-12 | The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce va… |
CVE-2025-12590 | Medium | 6.1 | 2025-11-11 | The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is… |
CVE-2025-12589 | Medium | 6.1 | 2025-11-11 | The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. Thi… |
CVE-2025-12588 | Medium | 4.3 | 2025-11-11 | The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is d… |
CVE-2025-12132 | Medium | 4.3 | 2025-11-11 | The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due… |
CVE-2025-11886 | Medium | 4.3 | 2025-11-11 | The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incor… |
CVE-2025-63712 | High | 8.8 | 2025-11-10 | Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to d… |
CVE-2025-63711 | High | 7.1 | 2025-11-10 | A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated admi… |
CVE-2025-63710 | Medium | 6.5 | 2025-11-10 | The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implem… |
CVE-2025-63717 | Medium | 6.5 | 2025-11-07 | The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Req… |
CVE-2025-63716 | Medium | 6.5 | 2025-11-07 | The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The ap… |
CVE-2025-58469 | High | 8.8 | 2025-11-07 | A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain pri… |
CVE-2025-62950 | Medium | 4.3 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forger… |
CVE-2025-53316 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR C… |
CVE-2025-48085 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0… |
CVE-2025-48083 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a throu… |
CVE-2025-48078 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a th… |
CVE-2025-48077 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a throu… |
CVE-2025-10691 | Medium | 4.3 | 2025-11-06 | The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing… |
CVE-2025-12456 | Medium | 6.1 | 2025-11-04 | The Centangle-Team plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or inco… |
CVE-2025-12452 | Medium | 6.1 | 2025-11-04 | The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the… |