CWE-352 · Cross-Site Request Forgery (CSRF) (page 36)
Page 36 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41603 | Critical | 9.6 | 2024-07-19 | Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. |
CVE-2024-41602 | High | 8.8 | 2024-07-19 | Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL |
CVE-2023-7269 | High | 7.5 | 2024-07-19 | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-39090 | Medium | 6.1 | 2024-07-18 | The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site S… |
CVE-2024-39681 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39680 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39679 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39678 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to… |
CVE-2024-40119 | High | 8.8 | 2024-07-17 | Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password cha… |
CVE-2024-5815 | Medium | 6.5 | 2024-07-16 | A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request ty… |
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |
CVE-2024-6075 | High | 8.8 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-5287 | High | 7.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2024-5284 | Medium | 6.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5280 | Medium | 4.7 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5167 | High | 8.1 | 2024-07-13 | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or… |
CVE-2024-5077 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-5076 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-5034 | High | 8.8 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions… |
CVE-2024-5033 | Medium | 5.9 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers t… |
CVE-2024-5028 | Medium | 6.5 | 2024-07-13 | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged i… |
CVE-2024-3632 | Medium | 6.8 | 2024-07-13 | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-37941 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Ju… |
CVE-2024-37940 | High | 7.4 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Fu… |
CVE-2024-37939 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3. |
CVE-2024-37938 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10. |
CVE-2024-37213 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in guru-aliexpress AliNext ali2woo-lite allows Cross Site Request Forgery.This issue affects AliNext: from n/a… |
CVE-2024-35773 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Em… |
CVE-2024-6024 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged i… |
CVE-2024-6023 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perf… |
CVE-2024-6022 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-1375 | Medium | 4.3 | 2024-07-12 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versi… |
CVE-2024-1845 | High | 8.8 | 2024-07-11 | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged… |
CVE-2024-6649 | Medium | 4.3 | 2024-07-10 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2024-40332 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord |
CVE-2024-40331 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup |
CVE-2024-40334 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 |
CVE-2024-40329 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup |
CVE-2024-40328 | Medium | 6.3 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 |
CVE-2024-28828 | High | 8.8 | 2024-07-10 | Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site. |
CVE-2024-3798 | | 2024-07-10 | Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create… | |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-39063 | High | 8.8 | 2024-07-09 | Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the… |
CVE-2024-40039 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del |
CVE-2024-40038 | Medium | 5.3 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev |
CVE-2024-40037 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del |
CVE-2024-40035 | Medium | 5.9 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. |
CVE-2024-40034 | High | 8.8 | 2024-07-09 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del |
CVE-2024-27783 | High | 7.6 | 2024-07-09 | Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perf… |
CVE-2024-6168 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or… |
CVE-2024-4100 | Medium | 5.3 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incor… |
CVE-2024-6321 | High | 8.8 | 2024-07-09 | The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is… |
CVE-2024-6320 | High | 8.8 | 2024-07-09 | The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due… |
CVE-2024-6317 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6316 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6310 | High | 8.8 | 2024-07-09 | The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7… |
CVE-2024-6309 | High | 8.8 | 2024-07-09 | The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including… |
CVE-2024-37923 | Medium | 5.4 | 2024-07-09 | Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: fr… |
CVE-2023-47677 | High | 8.8 | 2024-07-08 | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ne… |
CVE-2024-40603 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. |
CVE-2024-40601 | Medium | 6.5 | 2024-07-07 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. |
CVE-2024-5616 | Medium | 4.3 | 2024-07-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into de… |
CVE-2024-39023 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
CVE-2024-39022 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
CVE-2024-39021 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
CVE-2024-39020 | Medium | 6.3 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-39019 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
CVE-2024-27717 | Medium | 6.5 | 2024-07-05 | Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via… |
CVE-2024-5943 | High | 8.8 | 2024-07-04 | The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorr… |
CVE-2024-38345 | High | 8.1 | 2024-07-04 | A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user w… |
CVE-2024-38344 | Medium | 5.4 | 2024-07-04 | A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who… |
CVE-2024-2376 | High | 8.8 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-2235 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those t… |
CVE-2024-2233 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions v… |
CVE-2024-2040 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack |
CVE-2024-4543 | Medium | 4.3 | 2024-07-03 | The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or… |
CVE-2024-39326 | Medium | 4.4 | 2024-07-02 | SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectname}/skills/{skillname}/video` (and proba… |
CVE-2024-39119 | Medium | 5.4 | 2024-07-02 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-5767 | High | 8.8 | 2024-07-02 | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-23737 | Medium | 5.4 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME… |
CVE-2024-23736 | High | 8.8 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of… |
CVE-2024-31902 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2024-6405 | Medium | 6.1 | 2024-06-29 | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing… |
CVE-2024-5712 | High | 8.1 | 2024-06-28 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows a… |
CVE-2024-5935 | Medium | 5.4 | 2024-06-27 | A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This… |
CVE-2024-39158 | High | 8.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet. |
CVE-2024-39157 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1. |
CVE-2024-39156 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add. |
CVE-2024-39155 | Medium | 6.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add. |
CVE-2024-39154 | High | 8.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. |
CVE-2024-39153 | Medium | 4.7 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. |
CVE-2024-4758 | High | 7.6 | 2024-06-26 | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logg… |
CVE-2024-4757 | High | 8.1 | 2024-06-25 | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul… |
CVE-2021-45785 | Medium | 6.5 | 2024-06-24 | TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, c… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-4499 | Medium | 6.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows a… |
CVE-2024-5596 | Medium | 6.3 | 2024-06-22 | The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly impleme… |
CVE-2024-3593 | High | 7.2 | 2024-06-22 | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect… |
CVE-2024-37230 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3. |
CVE-2024-37227 | Medium | 4.3 | 2024-06-21 | Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7. |