CWE-352 · Cross-Site Request Forgery (CSRF) (page 2)
Page 2 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82764 | Medium | 4.3 | 2026-09-14 | Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product… |
CVE-2026-90599 | Medium | 4.3 | 2026-09-13 | A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file incl… |
CVE-2026-84024 | Medium | 4.3 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configu… |
CVE-2026-84023 | Medium | 6.5 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify… |
CVE-2026-81090 | High | 7.2 | 2026-09-12 | The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing at… |
CVE-2026-49992 | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creat… | |
CVE-2026-81907 | High | 7.1 | 2026-09-11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/expre… |
CVE-2026-50025 | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… | |
CVE-2026-81912 | Medium | 5.7 | 2026-09-11 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endp… |
CVE-2026-68526 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.ph… |
CVE-2026-62139 | Medium | 4.3 | 2026-09-11 | Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. |
CVE-2026-62133 | Medium | 5.4 | 2026-09-11 | Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. |
CVE-2026-89245 | Medium | 6.5 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attac… |
CVE-2026-89148 | Medium | 5.4 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php… |
CVE-2026-80380 | High | 7.1 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery. |
CVE-2026-88061 | | 2026-09-10 | career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-sp… | |
CVE-2026-84432 | | 2026-09-10 | Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.ph… | |
CVE-2026-88873 | High | 7.1 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows… |
CVE-2026-88872 | High | 7.1 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that al… |
CVE-2026-88871 | Medium | 4.3 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUs… |
CVE-2026-88870 | High | 7.1 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endp… |
CVE-2026-78084 | | 2026-09-10 | Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked… | |
CVE-2026-78083 | | 2026-09-10 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor bookin… | |
CVE-2026-87449 | Medium | 4.3 | 2026-09-09 | Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a… |
CVE-2026-9215 | Medium | 6.7 | 2026-09-08 | A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router ad… |
CVE-2026-86724 | Medium | 6.5 | 2026-09-08 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php tha… |
CVE-2026-86719 | Medium | 5.4 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin en… |
CVE-2026-86718 | High | 7.1 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll… |
CVE-2026-86135 | | 2026-09-08 | A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized… | |
CVE-2026-33920 | Low | 3.5 | 2026-09-08 | A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token… |
CVE-2026-76961 | Low | 3.5 | 2026-09-08 | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacke… |
CVE-2026-76960 | Low | 3.5 | 2026-09-08 | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacke… |
CVE-2026-76959 | Medium | 4.6 | 2026-09-08 | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker… |
CVE-2026-86307 | Medium | 4.3 | 2026-09-07 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerabili… |
CVE-2026-86281 | Medium | 4.3 | 2026-09-07 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performi… |
CVE-2026-86182 | Medium | 4.3 | 2026-09-06 | A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/a… |
CVE-2026-52777 | | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserial… | |
CVE-2026-82712 | High | 8.8 | 2026-09-04 | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform… |
CVE-2026-53760 | Medium | 5.2 | 2026-09-04 | Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation… |
CVE-2026-82911 | | 2026-09-04 | Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unaut… | |
CVE-2026-85547 | | 2026-09-04 | A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request… | |
CVE-2026-85546 | | 2026-09-04 | MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServ… | |
CVE-2026-49455 | Medium | 6.5 | 2026-09-03 | Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origi… |
CVE-2026-85236 | High | 8.8 | 2026-09-03 | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible opera… |
CVE-2026-85162 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
CVE-2026-85161 | Medium | 4.3 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
CVE-2026-53649 | Critical | 9.6 | 2026-09-02 | Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication a… |
CVE-2026-84663 | Medium | 5.4 | 2026-09-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared… |
CVE-2026-84649 | High | 8.8 | 2026-09-02 | In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both i… |
CVE-2026-8151 | Medium | 5.4 | 2026-09-02 | The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-… |
CVE-2026-84770 | High | 8.8 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. |
CVE-2026-84764 | High | 8.8 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions. |
CVE-2026-84759 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions. |
CVE-2026-66652 | Medium | 5.4 | 2026-09-02 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5… |
CVE-2026-81432 | Medium | 4.3 | 2026-09-02 | The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-… |
CVE-2026-81426 | Medium | 4.3 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attacke… |
CVE-2026-73780 | High | 8.3 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This… |
CVE-2026-73718 | High | 7.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive info… |
CVE-2026-18780 | High | 7.1 | 2026-09-01 | Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request F… |
CVE-2026-83595 | High | 8.1 | 2026-09-01 | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET r… |
CVE-2026-81890 | Medium | 5.4 | 2026-08-31 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector… |
CVE-2026-81888 | Medium | 5.4 | 2026-08-31 | @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the… |
CVE-2026-54599 | | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oid… | |
CVE-2026-71378 | Medium | 4.6 | 2026-08-31 | ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy j… |
CVE-2026-82647 | Medium | 6.1 | 2026-08-30 | WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's con… |
CVE-2026-82544 | Medium | 4.3 | 2026-08-30 | A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the com… |
CVE-2026-82468 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cr… |
CVE-2026-17522 | Medium | 5.4 | 2026-08-29 | The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted… |
CVE-2026-81733 | | 2026-08-28 | WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The… | |
CVE-2026-78610 | | 2026-08-28 | WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global… | |
CVE-2026-75814 | High | 8.8 | 2026-08-28 | The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attac… |
CVE-2026-80210 | Medium | 6.5 | 2026-08-27 | FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it re… |
CVE-2026-81273 | High | 8.1 | 2026-08-27 | Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. |
CVE-2026-81271 | High | 8.8 | 2026-08-27 | Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions. |
CVE-2026-76549 | Medium | 5.9 | 2026-08-27 | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could all… |
CVE-2025-56798 | High | 8.8 | 2026-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges… |
CVE-2026-48549 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie pr… |
CVE-2026-48548 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagForm… |
CVE-2026-55532 | High | 7.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the atta… |
CVE-2026-78280 | Medium | 4.3 | 2026-08-24 | Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions. |
CVE-2026-78279 | Medium | 5.4 | 2026-08-24 | Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions. |
CVE-2026-58003 | High | 7.1 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks… |
CVE-2026-58001 | Medium | 5.7 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks an… |
CVE-2026-57944 | Medium | 5.4 | 2026-08-22 | AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Galle… |
CVE-2026-67361 | | 2026-08-21 | Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file… | |
CVE-2026-67358 | | 2026-08-21 | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order t… | |
CVE-2026-77029 | | 2026-08-21 | Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66 | |
CVE-2026-15046 | Medium | 4.2 | 2026-08-21 | The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authent… |
CVE-2026-77391 | Medium | 4.3 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipul… |
CVE-2026-66001 | | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the… | |
CVE-2026-63654 | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frap… | |
CVE-2026-64962 | | 2026-08-20 | ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an… | |
CVE-2026-28164 | Critical | 9.6 | 2026-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addon… |
CVE-2026-76610 | | 2026-08-20 | Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized… | |
CVE-2026-14951 | High | 8.0 | 2026-08-20 | An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. |
CVE-2026-76334 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action… |
CVE-2026-63123 | Medium | 6.5 | 2026-08-19 | Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin call… |
CVE-2026-18848 | High | 8.3 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in… |
CVE-2026-62671 | Medium | 5.4 | 2026-08-19 | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top… |
CVE-2026-75952 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/… |