CWE-352 · Cross-Site Request Forgery (CSRF) (page 35)
Page 35 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7647 | Medium | 6.1 | 2024-08-21 | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to… |
CVE-2024-42619 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg… |
CVE-2024-42612 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add |
CVE-2024-42621 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php |
CVE-2024-42618 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma |
CVE-2024-42617 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32 |
CVE-2024-42616 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics |
CVE-2024-42613 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet |
CVE-2024-42611 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete |
CVE-2024-42610 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files |
CVE-2024-42609 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars |
CVE-2024-42607 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database |
CVE-2024-42606 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1 |
CVE-2024-42605 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1 |
CVE-2024-42604 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3 |
CVE-2024-42603 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall |
CVE-2024-42608 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php. |
CVE-2024-42586 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42585 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42584 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42583 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42582 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42581 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42580 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42579 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42578 | High | 8.0 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42577 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42576 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42557 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42555 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42553 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-7850 | Medium | 6.1 | 2024-08-20 | The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or i… |
CVE-2023-3409 | Medium | 5.4 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-3408 | Medium | 4.3 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-1604 | Medium | 4.7 | 2024-08-17 | The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect non… |
CVE-2024-7501 | Medium | 4.2 | 2024-08-16 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2024-7422 | Medium | 4.3 | 2024-08-16 | The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or inco… |
CVE-2024-42476 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site re… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-7420 | Medium | 5.8 | 2024-08-15 | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missin… |
CVE-2024-39410 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-39409 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-39408 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow a… |
CVE-2024-38724 | High | 7.1 | 2024-08-13 | Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman… |
CVE-2024-42627 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3. |
CVE-2024-42626 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add. |
CVE-2024-42625 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add |
CVE-2024-42624 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10. |
CVE-2024-42623 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1 |
CVE-2024-42632 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add. |
CVE-2024-42631 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1. |
CVE-2024-42630 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file. |
CVE-2024-42629 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10. |
CVE-2024-42628 | High | 8.8 | 2024-08-12 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3. |
CVE-2024-7662 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. This vulnerability affects the funct… |
CVE-2024-7661 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been classified as problematic. This affects the function save_use… |
CVE-2024-7645 | Medium | 4.3 | 2024-08-12 | A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code… |
CVE-2024-7574 | Medium | 6.1 | 2024-08-12 | The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce valida… |
CVE-2024-6136 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-40488 | High | 8.8 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administr… |
CVE-2024-40476 | High | 8.0 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking… |
CVE-2024-7492 | High | 8.8 | 2024-08-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or… |
CVE-2024-6720 | High | 8.8 | 2024-08-06 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-41811 | Low | 3.9 | 2024-08-05 | ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site… |
CVE-2024-5081 | Medium | 6.1 | 2024-08-05 | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2024-2232 | High | 8.1 | 2024-08-05 | The lacks CSRF checks allowing a user to invite any user to any group (including private groups) |
CVE-2024-7460 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2024-7459 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been classified as problematic. Affected is an unknown function of the file /edi… |
CVE-2024-38776 | High | 7.1 | 2024-08-02 | Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a t… |
CVE-2024-3238 | High | 8.8 | 2024-08-02 | The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0… |
CVE-2024-7367 | Medium | 4.3 | 2024-08-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /aj… |
CVE-2024-32863 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) |
CVE-2024-7360 | Medium | 4.3 | 2024-08-01 | A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknown part of the file… |
CVE-2024-6040 | High | 8.8 | 2024-08-01 | In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifica… |
CVE-2024-6496 | Medium | 6.5 | 2024-08-01 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such a… |
CVE-2024-3983 | High | 8.1 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in ad… |
CVE-2024-2843 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin us… |
CVE-2024-1747 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users… |
CVE-2024-40883 | High | 8.8 | 2024-08-01 | Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an admin… |
CVE-2024-3083 | High | 8.3 | 2024-07-31 | A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luri… |
CVE-2024-6412 | Medium | 6.5 | 2024-07-31 | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-41305 | Medium | 4.7 | 2024-07-30 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection… |
CVE-2023-38001 | Medium | 6.5 | 2024-07-30 | IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitt… |
CVE-2024-7226 | Medium | 4.3 | 2024-07-30 | A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-6230 | Medium | 6.5 | 2024-07-30 | The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a… |
CVE-2024-5808 | Medium | 4.3 | 2024-07-30 | The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers… |
CVE-2024-40815 | High | 7.5 | 2024-07-29 | A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6… |
CVE-2024-5285 | Medium | 5.5 | 2024-07-29 | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logge… |
CVE-2024-7169 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php… |
CVE-2024-7161 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=c… |
CVE-2024-6490 | Medium | 6.5 | 2024-07-26 | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests… |
CVE-2024-7106 | Medium | 4.3 | 2024-07-25 | A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_fo… |
CVE-2024-7065 | Medium | 4.3 | 2024-07-24 | A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The mani… |
CVE-2024-3246 | Medium | 6.1 | 2024-07-24 | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or i… |
CVE-2024-6751 | Medium | 6.3 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or inc… |
CVE-2024-6271 | Medium | 5.4 | 2024-07-22 | The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin… |
CVE-2024-6244 | High | 8.8 | 2024-07-22 | The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unw… |
CVE-2024-5804 | Medium | 4.3 | 2024-07-20 | The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is du… |
CVE-2024-41597 | Medium | 4.2 | 2024-07-19 | Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because… |
CVE-2024-41603 | Critical | 9.6 | 2024-07-19 | Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. |