CWE-352 · Cross-Site Request Forgery (CSRF) (page 33)
Page 33 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43116 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10. |
CVE-2024-39657 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – N… |
CVE-2024-39645 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. |
CVE-2024-39641 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2. |
CVE-2024-39628 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a throug… |
CVE-2024-42792 | Low | 3.5 | 2024-08-26 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. |
CVE-2024-8120 | Medium | 4.7 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is… |
CVE-2024-7568 | Critical | 9.6 | 2024-08-24 | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorre… |
CVE-2024-42764 | Critical | 9.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. |
CVE-2024-42768 | Medium | 6.8 | 2024-08-22 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. |
CVE-2024-43787 | Medium | 5.0 | 2024-08-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. M… |
CVE-2024-39744 | Medium | 4.3 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2024-40886 | Medium | 4.6 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection… |
CVE-2024-42056 | Medium | 6.5 | 2024-08-22 | Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be… |
CVE-2024-20486 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2024-7647 | Medium | 6.1 | 2024-08-21 | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to… |
CVE-2024-42619 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg… |
CVE-2024-42612 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add |
CVE-2024-42621 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php |
CVE-2024-42618 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma |
CVE-2024-42617 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32 |
CVE-2024-42616 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics |
CVE-2024-42613 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet |
CVE-2024-42611 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete |
CVE-2024-42610 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files |
CVE-2024-42609 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars |
CVE-2024-42607 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database |
CVE-2024-42606 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1 |
CVE-2024-42605 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1 |
CVE-2024-42604 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3 |
CVE-2024-42603 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall |
CVE-2024-42608 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php. |
CVE-2024-42586 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42585 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42584 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42583 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42582 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42581 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42580 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42579 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42578 | High | 8.0 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42577 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42576 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42557 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42555 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42553 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-7850 | Medium | 6.1 | 2024-08-20 | The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or i… |
CVE-2023-3409 | Medium | 5.4 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-3408 | Medium | 4.3 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-1604 | Medium | 4.7 | 2024-08-17 | The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect non… |
CVE-2024-7501 | Medium | 4.2 | 2024-08-16 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2024-7422 | Medium | 4.3 | 2024-08-16 | The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or inco… |
CVE-2024-42476 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site re… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-7420 | Medium | 5.8 | 2024-08-15 | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missin… |
CVE-2024-39410 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-39409 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-39408 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-38724 | High | 7.1 | 2024-08-13 | Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman… |
CVE-2024-42627 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3. |
CVE-2024-42626 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add. |
CVE-2024-42625 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add |
CVE-2024-42624 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10. |
CVE-2024-42623 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1 |
CVE-2024-42632 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add. |
CVE-2024-42631 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1. |
CVE-2024-42630 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file. |
CVE-2024-42629 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10. |
CVE-2024-42628 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3. |
CVE-2024-7662 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. This vulnerability affects the funct… |
CVE-2024-7661 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been classified as problematic. This affects the function save_use… |
CVE-2024-7645 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code… |
CVE-2024-7574 | Medium | 6.1 | 2024-08-12 | The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce valida… |
CVE-2024-6136 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-40488 | High | 8.8 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administr… |
CVE-2024-40476 | High | 8.0 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking… |
CVE-2024-7492 | High | 8.8 | 2024-08-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or… |
CVE-2024-6720 | High | 8.8 | 2024-08-06 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-41811 | Low | 3.9 | 2024-08-05 | ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site… |
CVE-2024-5081 | Medium | 6.1 | 2024-08-05 | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2024-2232 | High | 8.1 | 2024-08-05 | The lacks CSRF checks allowing a user to invite any user to any group (including private groups) |
CVE-2024-7460 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2024-7459 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been classified as problematic. Affected is an unknown function of the file /edi… |
CVE-2024-38776 | High | 7.1 | 2024-08-02 | Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a t… |
CVE-2024-3238 | High | 8.8 | 2024-08-02 | The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0… |
CVE-2024-7367 | Medium | 4.3 | 2024-08-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /aj… |
CVE-2024-32863 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) |
CVE-2024-7360 | Medium | 4.3 | 2024-08-01 | A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknown part of the file… |
CVE-2024-6040 | High | 8.8 | 2024-08-01 | In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifica… |
CVE-2024-6496 | Medium | 6.5 | 2024-08-01 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such a… |
CVE-2024-3983 | High | 8.1 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in ad… |
CVE-2024-2843 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin us… |
CVE-2024-1747 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users… |
CVE-2024-40883 | High | 8.8 | 2024-08-01 | Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an admin… |
CVE-2024-3083 | High | 8.3 | 2024-07-31 | A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luri… |
CVE-2024-6412 | Medium | 6.5 | 2024-07-31 | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-41305 | Medium | 4.7 | 2024-07-30 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection… |
CVE-2023-38001 | Medium | 6.5 | 2024-07-30 | IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitt… |
CVE-2024-7226 | Medium | 4.3 | 2024-07-30 | A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-6230 | Medium | 6.5 | 2024-07-30 | The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a… |