CWE-352 · Cross-Site Request Forgery (CSRF) (page 34)
Page 34 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43684 | High | 8.8 | 2024-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects… |
CVE-2024-8520 | Medium | 5.3 | 2024-10-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-… |
CVE-2024-41987 | | 2024-10-03 | The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks… | |
CVE-2024-42504 | Medium | 4.3 | 2024-10-03 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow. |
CVE-2023-7273 | Medium | 6.8 | 2024-10-01 | Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created… |
CVE-2024-8458 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker… |
CVE-2024-28948 | High | 8.0 | 2024-09-27 | Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin policy, which is de… |
CVE-2024-9282 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipul… |
CVE-2024-9281 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The… |
CVE-2024-45987 | Medium | 6.5 | 2024-09-26 | Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft… |
CVE-2024-45983 | Medium | 6.3 | 2024-09-26 | A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craf… |
CVE-2024-45372 | Medium | 6.5 | 2024-09-26 | MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web manageme… |
CVE-2024-47315 | Medium | 5.4 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1. |
CVE-2024-47305 | Medium | 4.3 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: fro… |
CVE-2024-47082 | Medium | 4.6 | 2024-09-25 | Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request… |
CVE-2024-20437 | High | 8.1 | 2024-09-25 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request… |
CVE-2024-20414 | Medium | 6.5 | 2024-09-25 | A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site r… |
CVE-2024-46600 | Medium | 4.7 | 2024-09-25 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31 |
CVE-2024-46485 | Medium | 6.3 | 2024-09-25 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate |
CVE-2024-7892 | Medium | 4.3 | 2024-09-25 | The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-8476 | Medium | 4.3 | 2024-09-25 | The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or… |
CVE-2024-7386 | Medium | 4.3 | 2024-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5… |
CVE-2024-8795 | High | 8.8 | 2024-09-24 | The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or… |
CVE-2024-46394 | High | 8.8 | 2024-09-19 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add |
CVE-2024-46086 | High | 8.8 | 2024-09-18 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123 |
CVE-2024-44064 | High | 7.1 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.This issue… |
CVE-2024-46362 | High | 8.8 | 2024-09-17 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory |
CVE-2024-46085 | High | 8.8 | 2024-09-17 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename |
CVE-2024-8490 | High | 8.8 | 2024-09-17 | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incor… |
CVE-2024-8093 | Medium | 6.5 | 2024-09-17 | The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-8092 | Medium | 5.4 | 2024-09-17 | The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-8091 | Medium | 6.5 | 2024-09-17 | The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-8052 | Medium | 6.1 | 2024-09-17 | The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow att… |
CVE-2024-8051 | Medium | 5.4 | 2024-09-17 | The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-8047 | Medium | 6.5 | 2024-09-17 | The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8044 | Medium | 6.5 | 2024-09-17 | The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8043 | Medium | 5.4 | 2024-09-17 | The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-6862 | High | 8.1 | 2024-09-13 | A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows a… |
CVE-2024-7423 | High | 8.8 | 2024-09-13 | The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect no… |
CVE-2024-7864 | Medium | 6.5 | 2024-09-13 | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers… |
CVE-2024-7863 | Medium | 6.8 | 2024-09-13 | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to… |
CVE-2024-7862 | Medium | 6.5 | 2024-09-12 | The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers… |
CVE-2024-7859 | Medium | 6.5 | 2024-09-12 | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-7820 | Medium | 6.5 | 2024-09-12 | The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-7817 | Medium | 6.5 | 2024-09-12 | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbi… |
CVE-2024-7816 | Medium | 6.1 | 2024-09-12 | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-6017 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could al… |
CVE-2024-3163 | Medium | 4.3 | 2024-09-12 | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged… |
CVE-2024-44677 | Critical | 9.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java… |
CVE-2023-2919 | Medium | 4.3 | 2024-09-10 | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect non… |
CVE-2024-45504 | Medium | 6.5 | 2024-09-10 | Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hi… |
CVE-2024-7689 | Medium | 4.3 | 2024-09-09 | The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-7688 | Medium | 6.5 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary index… |
CVE-2024-7687 | Medium | 4.3 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-6925 | Medium | 4.3 | 2024-09-08 | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-6856 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-6855 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perf… |
CVE-2024-6853 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins p… |
CVE-2024-6852 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-45172 | Medium | 6.8 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerabl… |
CVE-2024-8414 | Medium | 4.3 | 2024-09-04 | A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2024-7690 | Medium | 4.3 | 2024-09-02 | The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-45527 | Medium | 6.1 | 2024-09-02 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also… |
CVE-2024-45270 | Medium | 4.3 | 2024-09-02 | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged i… |
CVE-2024-45269 | Medium | 4.3 | 2024-09-02 | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logg… |
CVE-2024-8319 | Medium | 4.3 | 2024-08-30 | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect… |
CVE-2024-43947 | Medium | 5.4 | 2024-08-29 | Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26. |
CVE-2024-42793 | High | 8.0 | 2024-08-28 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_… |
CVE-2024-8200 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2024-45264 | High | 8.8 | 2024-08-27 | A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator… |
CVE-2024-43356 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0. |
CVE-2024-43340 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4. |
CVE-2024-43339 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20. |
CVE-2024-43337 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. |
CVE-2024-43336 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9… |
CVE-2024-43325 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3. |
CVE-2024-43316 | Medium | 5.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooComme… |
CVE-2024-43301 | High | 7.1 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7. |
CVE-2024-43299 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8. |
CVE-2024-43295 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7. |
CVE-2024-43287 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMT… |
CVE-2024-43269 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1… |
CVE-2024-43265 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1. |
CVE-2024-43255 | High | 7.1 | 2024-08-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue af… |
CVE-2024-43117 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Humming… |
CVE-2024-43116 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10. |
CVE-2024-39657 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – N… |
CVE-2024-39645 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. |
CVE-2024-39641 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2. |
CVE-2024-39628 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a throug… |
CVE-2024-42792 | Low | 3.5 | 2024-08-26 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. |
CVE-2024-8120 | Medium | 4.7 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is… |
CVE-2024-7568 | Critical | 9.6 | 2024-08-24 | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorre… |
CVE-2024-42764 | Critical | 9.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. |
CVE-2024-42768 | Medium | 6.8 | 2024-08-22 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. |
CVE-2024-43787 | Medium | 5.0 | 2024-08-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. M… |
CVE-2024-39744 | Medium | 4.3 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2024-40886 | Medium | 4.6 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection… |
CVE-2024-42056 | Medium | 6.5 | 2024-08-22 | Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be… |
CVE-2024-20486 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |