CWE-352 · Cross-Site Request Forgery (CSRF) (page 35)
Page 35 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39157 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1. |
CVE-2024-39156 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add. |
CVE-2024-39155 | Medium | 6.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add. |
CVE-2024-39154 | High | 8.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. |
CVE-2024-39153 | Medium | 4.7 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. |
CVE-2024-4758 | High | 7.6 | 2024-06-26 | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logg… |
CVE-2024-4757 | High | 8.1 | 2024-06-25 | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul… |
CVE-2021-45785 | Medium | 6.5 | 2024-06-24 | TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, c… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-4499 | Medium | 6.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows a… |
CVE-2024-5596 | Medium | 6.3 | 2024-06-22 | The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly impleme… |
CVE-2024-3593 | High | 7.2 | 2024-06-22 | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect… |
CVE-2024-37230 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3. |
CVE-2024-37227 | Medium | 4.3 | 2024-06-21 | Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7. |
CVE-2024-37212 | High | 8.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5. |
CVE-2024-37198 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5. |
CVE-2024-37118 | Medium | 5.4 | 2024-06-21 | Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3. |
CVE-2024-35772 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24. |
CVE-2024-35771 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21. |
CVE-2024-35770 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gall… |
CVE-2024-4969 | Medium | 4.3 | 2024-06-21 | The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/dis… |
CVE-2024-4475 | Medium | 4.3 | 2024-06-21 | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the lo… |
CVE-2024-4474 | Medium | 4.3 | 2024-06-21 | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2024-4382 | Medium | 6.5 | 2024-06-21 | The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2023-25697 | Medium | 5.4 | 2024-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6. |
CVE-2024-5676 | Medium | 6.8 | 2024-06-19 | The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of… |
CVE-2023-50900 | Medium | 4.3 | 2024-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10. |
CVE-2024-1407 | Medium | 5.4 | 2024-06-19 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-5343 | High | 8.8 | 2024-06-19 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2024-4541 | Medium | 4.3 | 2024-06-19 | The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to miss… |
CVE-2024-38276 | High | 8.8 | 2024-06-18 | Incorrect CSRF token checks resulted in multiple CSRF risks. |
CVE-2024-38457 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows CSRF. |
CVE-2024-5551 | High | 7.5 | 2024-06-14 | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This i… |
CVE-2024-5155 | Medium | 6.1 | 2024-06-14 | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow att… |
CVE-2024-4751 | Medium | 4.3 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2024-4480 | Medium | 6.1 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logge… |
CVE-2024-3993 | Medium | 4.6 | 2024-06-14 | The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attack… |
CVE-2024-3972 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-3971 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admi… |
CVE-2024-3965 | Medium | 5.4 | 2024-06-14 | The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-0892 | Medium | 4.3 | 2024-06-14 | The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2023-6492 | Medium | 4.3 | 2024-06-14 | The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2024-37306 | High | 7.1 | 2024-06-13 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2… |
CVE-2024-38293 | Critical | 9.6 | 2024-06-13 | ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php. |
CVE-2023-47845 | Medium | 4.3 | 2024-06-12 | Cross-Site Request Forgery (CSRF) vulnerability in Lim Kai Yang Grab & Save.This issue affects Grab & Save: from n/a through 1.0.4. |
CVE-2024-35207 | High | 7.8 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The web interface of the affected devices are vulnera… |
CVE-2024-31612 | Medium | 6.5 | 2024-06-10 | Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information. |
CVE-2024-31613 | Medium | 5.4 | 2024-06-10 | BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code." |
CVE-2024-4403 | High | 8.8 | 2024-06-10 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers… |
CVE-2024-5786 | Medium | 6.5 | 2024-06-10 | Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to fo… |
CVE-2024-4328 | High | 8.1 | 2024-06-10 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability aris… |
CVE-2024-35657 | Medium | 5.4 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6. |
CVE-2024-35689 | Medium | 5.4 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3. |
CVE-2024-35684 | Medium | 4.3 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1. |
CVE-2024-5003 | Medium | 5.4 | 2024-06-07 | The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-2288 | High | 8.3 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lo… |
CVE-2024-1879 | High | 8.8 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT… |
CVE-2023-6968 | High | 8.1 | 2024-06-06 | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or inco… |
CVE-2024-36670 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del |
CVE-2024-36669 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add. |
CVE-2024-36668 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del |
CVE-2024-36667 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close |
CVE-2024-35673 | Medium | 4.3 | 2024-06-05 | Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22. |
CVE-2024-2368 | Medium | 4.3 | 2024-06-05 | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incor… |
CVE-2024-36550 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close |
CVE-2024-36549 | High | 8.8 | 2024-06-04 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-36548 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del |
CVE-2024-36547 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add |
CVE-2024-35632 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Fo… |
CVE-2024-35638 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43. |
CVE-2024-4344 | Medium | 4.3 | 2024-06-02 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-35636 | Medium | 4.3 | 2024-06-01 | Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare Fi… |
CVE-2024-34008 | High | 8.8 | 2024-05-31 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. |
CVE-2024-34007 | High | 8.8 | 2024-05-31 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. |
CVE-2024-34001 | High | 8.4 | 2024-05-31 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. |
CVE-2024-4426 | Medium | 4.3 | 2024-05-30 | The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or i… |
CVE-2024-4218 | Medium | 6.5 | 2024-05-30 | The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plugin improperly rel… |
CVE-2024-3947 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-3945 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-3943 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-5185 | High | 7.3 | 2024-05-29 | The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromise… |
CVE-2024-4429 | Medium | 5.4 | 2024-05-28 | Cross-Site Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to sensitive information disclosure. |
CVE-2024-5428 | Medium | 4.3 | 2024-05-28 | A vulnerability classified as problematic was found in SourceCodester Simple Online Bidding System 1.0. Affected by this vulnerability is the function save_pro… |
CVE-2024-4535 | High | 8.8 | 2024-05-27 | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform… |
CVE-2024-4534 | Medium | 6.1 | 2024-05-27 | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2024-4532 | Medium | 6.4 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4531 | High | 7.1 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4530 | Medium | 6.3 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4529 | Medium | 5.0 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-36255 | Medium | 5.7 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run… |
CVE-2024-4409 | Medium | 4.3 | 2024-05-24 | The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrec… |
CVE-2023-7045 | Medium | 5.4 | 2024-05-23 | A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vuln… |
CVE-2024-35561 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35560 | Medium | 4.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. |
CVE-2024-35559 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35558 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35557 | Medium | 5.5 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35556 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. |
CVE-2024-35555 | Medium | 6.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=sta… |
CVE-2024-35554 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. |