CWE-352 · Cross-Site Request Forgery (CSRF) (page 34)
Page 34 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5808 | Medium | 4.3 | 2024-07-30 | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers… |
CVE-2024-40815 | High | 7.5 | 2024-07-29 | A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6… |
CVE-2024-5285 | Medium | 5.5 | 2024-07-29 | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logge… |
CVE-2024-7169 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php… |
CVE-2024-7161 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=c… |
CVE-2024-6490 | Medium | 6.5 | 2024-07-26 | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests… |
CVE-2024-7106 | Medium | 4.3 | 2024-07-25 | A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_fo… |
CVE-2024-7065 | Medium | 4.3 | 2024-07-24 | A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The mani… |
CVE-2024-3246 | Medium | 6.1 | 2024-07-24 | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or i… |
CVE-2024-6751 | Medium | 6.3 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or inc… |
CVE-2024-6271 | Medium | 5.4 | 2024-07-22 | The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin… |
CVE-2024-6244 | High | 8.8 | 2024-07-22 | The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unw… |
CVE-2024-5804 | Medium | 4.3 | 2024-07-20 | The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is du… |
CVE-2024-41597 | Medium | 4.2 | 2024-07-19 | Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because… |
CVE-2024-41603 | Critical | 9.6 | 2024-07-19 | Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. |
CVE-2024-41602 | High | 8.8 | 2024-07-19 | Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL |
CVE-2023-7269 | High | 7.5 | 2024-07-19 | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-39090 | Medium | 6.1 | 2024-07-18 | The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site S… |
CVE-2024-39681 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39680 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39679 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39678 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to… |
CVE-2024-40119 | High | 8.8 | 2024-07-17 | Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password cha… |
CVE-2024-5815 | Medium | 6.5 | 2024-07-16 | A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request ty… |
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |
CVE-2024-6075 | High | 8.8 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-5287 | High | 7.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2024-5284 | Medium | 6.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5280 | Medium | 4.7 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5167 | High | 8.1 | 2024-07-13 | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or… |
CVE-2024-5077 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-5076 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-5034 | High | 8.8 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions… |
CVE-2024-5033 | Medium | 5.9 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers t… |
CVE-2024-5028 | Medium | 6.5 | 2024-07-13 | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged i… |
CVE-2024-3632 | Medium | 6.8 | 2024-07-13 | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-37941 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Ju… |
CVE-2024-37940 | High | 7.4 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Fu… |
CVE-2024-37939 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3. |
CVE-2024-37938 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10. |
CVE-2024-37213 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in guru-aliexpress AliNext ali2woo-lite allows Cross Site Request Forgery.This issue affects AliNext: from n/a… |
CVE-2024-35773 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Em… |
CVE-2024-6024 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged i… |
CVE-2024-6023 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perf… |
CVE-2024-6022 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-1375 | Medium | 4.3 | 2024-07-12 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versi… |
CVE-2024-1845 | High | 8.8 | 2024-07-11 | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged… |
CVE-2024-6649 | Medium | 4.3 | 2024-07-10 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2024-40332 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord |
CVE-2024-40331 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup |
CVE-2024-40334 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 |
CVE-2024-40329 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup |
CVE-2024-40328 | Medium | 6.3 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 |
CVE-2024-28828 | High | 8.8 | 2024-07-10 | Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site. |
CVE-2024-3798 | | 2024-07-10 | Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create… | |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-39063 | High | 8.8 | 2024-07-09 | Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the… |
CVE-2024-40039 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del |
CVE-2024-40038 | Medium | 5.3 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev |
CVE-2024-40037 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del |
CVE-2024-40035 | Medium | 5.9 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. |
CVE-2024-40034 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del |
CVE-2024-27783 | High | 7.6 | 2024-07-09 | Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perf… |
CVE-2024-6168 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or… |
CVE-2024-4100 | Medium | 5.3 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incor… |
CVE-2024-6321 | High | 8.8 | 2024-07-09 | The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is… |
CVE-2024-6320 | High | 8.8 | 2024-07-09 | The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due… |
CVE-2024-6317 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6316 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6310 | High | 8.8 | 2024-07-09 | The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7… |
CVE-2024-6309 | High | 8.8 | 2024-07-09 | The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including… |
CVE-2024-37923 | Medium | 5.4 | 2024-07-09 | Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: fr… |
CVE-2023-47677 | High | 8.8 | 2024-07-08 | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ne… |
CVE-2024-40603 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. |
CVE-2024-40601 | Medium | 6.5 | 2024-07-07 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. |
CVE-2024-5616 | Medium | 4.3 | 2024-07-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into de… |
CVE-2024-39023 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
CVE-2024-39022 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
CVE-2024-39021 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
CVE-2024-39020 | Medium | 6.3 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-39019 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
CVE-2024-27717 | Medium | 6.5 | 2024-07-05 | Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via… |
CVE-2024-5943 | High | 8.8 | 2024-07-04 | The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorr… |
CVE-2024-38345 | High | 8.1 | 2024-07-04 | A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user w… |
CVE-2024-38344 | Medium | 5.4 | 2024-07-04 | A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who… |
CVE-2024-2376 | High | 8.8 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-2235 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those t… |
CVE-2024-2233 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions v… |
CVE-2024-2040 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack |
CVE-2024-4543 | Medium | 4.3 | 2024-07-03 | The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or… |
CVE-2024-39326 | Medium | 4.4 | 2024-07-02 | SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectname}/skills/{skillname}/video` (and proba… |
CVE-2024-39119 | Medium | 5.4 | 2024-07-02 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-5767 | High | 8.8 | 2024-07-02 | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-23737 | Medium | 5.4 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME… |
CVE-2024-23736 | High | 8.8 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of… |
CVE-2024-31902 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2024-6405 | Medium | 6.1 | 2024-06-29 | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing… |
CVE-2024-5712 | High | 8.1 | 2024-06-28 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows a… |
CVE-2024-5935 | Medium | 5.4 | 2024-06-27 | A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This… |
CVE-2024-39158 | High | 8.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet. |