CWE-352 · Cross-Site Request Forgery (CSRF) (page 31)
Page 31 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51156 | Medium | 4.7 | 2024-11-14 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'. |
CVE-2024-51687 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This issue affects Platform.ly Official: from… |
CVE-2024-51684 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1… |
CVE-2024-51688 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affe… |
CVE-2024-47914 | Medium | 4.5 | 2024-11-14 | VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) |
CVE-2024-11143 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due t… |
CVE-2024-10593 | Medium | 4.3 | 2024-11-13 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-28731 | Medium | 4.3 | 2024-11-12 | Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain s… |
CVE-2021-27704 | Medium | 6.5 | 2024-11-12 | Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page. |
CVE-2021-27701 | Medium | 4.7 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and… |
CVE-2024-11125 | Medium | 4.3 | 2024-11-12 | A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The… |
CVE-2024-51489 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51488 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51487 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51485 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51484 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51647 | High | 7.1 | 2024-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through… |
CVE-2024-51630 | High | 7.1 | 2024-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Lars Schenk Responsive Flickr Gallery responsive-flickr-gallery allows Stored XSS.This issue affects Respons… |
CVE-2024-52002 | High | 8.8 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please… |
CVE-2024-51157 | Medium | 4.7 | 2024-11-08 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.html. |
CVE-2024-50966 | Critical | 9.3 | 2024-11-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. |
CVE-2019-20460 | High | 8.8 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require (anti-)CSRF tokens or other mechanisms for validating… |
CVE-2020-11919 | High | 8.0 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. There is no CSRF protection. |
CVE-2024-51382 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can resul… |
CVE-2024-51381 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin… |
CVE-2024-10711 | High | 8.8 | 2024-11-05 | The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or… |
CVE-2024-9689 | Medium | 4.3 | 2024-11-05 | The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform… |
CVE-2024-31998 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 a… |
CVE-2024-48057 | Medium | 6.1 | 2024-11-04 | localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time s… |
CVE-2024-30617 | Medium | 5.4 | 2024-11-04 | A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post… |
CVE-2024-41744 | Medium | 6.5 | 2024-11-01 | IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted f… |
CVE-2024-47359 | Medium | 5.3 | 2024-11-01 | Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2. |
CVE-2024-39639 | Medium | 4.3 | 2024-11-01 | Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-10605 | Medium | 4.3 | 2024-11-01 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /f… |
CVE-2024-49685 | Medium | 5.4 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This… |
CVE-2024-49674 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-43984 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n… |
CVE-2024-43930 | Medium | 4.3 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in eyecix JobSearch allows Cross Site Request Forgery.This issue affects JobSearch: from n/a through 2.5.3. |
CVE-2024-9434 | Medium | 6.1 | 2024-10-31 | The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2024-48311 | High | 8.8 | 2024-10-31 | Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. |
CVE-2024-10557 | Medium | 4.3 | 2024-10-31 | A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2024-24777 | High | 8.8 | 2024-10-30 | A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially crafted HTTP reques… |
CVE-2024-9990 | High | 8.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in… |
CVE-2024-50466 | Medium | 4.3 | 2024-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery… |
CVE-2024-6673 | Medium | 6.5 | 2024-10-29 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui reposit… |
CVE-2024-49672 | High | 7.1 | 2024-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs R… |
CVE-2024-46872 | Medium | 4.6 | 2024-10-29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows… |
CVE-2024-48291 | Medium | 6.3 | 2024-10-28 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17 |
CVE-2024-48191 | Medium | 6.3 | 2024-10-28 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17 |
CVE-2024-10448 | Medium | 4.3 | 2024-10-28 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown… |
CVE-2022-30357 | High | 8.8 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters… |
CVE-2023-26248 | Medium | 5.3 | 2024-10-25 | The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who… |
CVE-2024-9598 | High | 8.8 | 2024-10-25 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This… |
CVE-2024-47879 | High | 7.6 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expre… |
CVE-2024-9943 | Medium | 6.3 | 2024-10-24 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-10045 | Medium | 4.3 | 2024-10-23 | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or… |
CVE-2024-8980 | Critical | 9.6 | 2024-10-22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35… |
CVE-2024-26273 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26272 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26271 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q… |
CVE-2024-9588 | Medium | 5.4 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to… |
CVE-2024-43945 | Medium | 6.5 | 2024-10-21 | Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91. |
CVE-2024-49628 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forger… |
CVE-2024-49627 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from… |
CVE-2024-49306 | Medium | 5.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forge… |
CVE-2024-49290 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1… |
CVE-2024-49275 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: f… |
CVE-2024-49274 | Medium | 5.4 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD In… |
CVE-2024-49272 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto… |
CVE-2024-49250 | Medium | 4.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affec… |
CVE-2024-47634 | Medium | 5.4 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cro… |
CVE-2024-49629 | High | 7.1 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless… |
CVE-2024-49617 | High | 8.2 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracke… |
CVE-2024-49615 | High | 8.2 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms… |
CVE-2024-49605 | High | 7.1 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a thro… |
CVE-2024-49335 | High | 7.1 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive fo… |
CVE-2024-49622 | High | 8.2 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider… |
CVE-2024-49621 | High | 8.2 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affe… |
CVE-2023-6243 | Medium | 4.3 | 2024-10-19 | The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2024-10040 | Medium | 5.3 | 2024-10-18 | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or inc… |
CVE-2024-49313 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: f… |
CVE-2024-49304 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking Syst… |
CVE-2024-49237 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n… |
CVE-2024-49223 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change H… |
CVE-2024-49221 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a throug… |
CVE-2024-49220 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: fro… |
CVE-2024-48048 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <=… |
CVE-2024-48037 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects C… |
CVE-2024-48031 | Medium | 6.5 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpm… |
CVE-2024-48047 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request… |
CVE-2024-48038 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4. |
CVE-2024-9352 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-9351 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-48758 | Medium | 6.1 | 2024-10-16 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a rem… |
CVE-2024-20421 | High | 7.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-45693 | High | 8.0 | 2024-10-16 | Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the request… |
CVE-2024-8507 | High | 8.8 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or in… |
CVE-2020-36839 | High | 8.3 | 2024-10-16 | The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect… |
CVE-2020-36836 | High | 8.0 | 2024-10-16 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capa… |
CVE-2024-9649 | Medium | 4.3 | 2024-10-16 | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |