CWE-352 · Cross-Site Request Forgery (CSRF) (page 41)
Page 41 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0432 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-0431 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-1943 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce… |
CVE-2024-1912 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1910 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1909 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1907 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1906 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2023-7203 | Medium | 6.1 | 2024-02-27 | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to… |
CVE-2023-7202 | Medium | 6.1 | 2024-02-27 | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated user… |
CVE-2023-36237 | High | 8.8 | 2024-02-26 | Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. |
CVE-2024-1889 | High | 8.8 | 2024-02-26 | Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a maliciou… |
CVE-2023-32344 | Medium | 4.3 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary… |
CVE-2024-1362 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1361 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1360 | Medium | 4.3 | 2024-02-23 | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrec… |
CVE-2024-1777 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. Th… |
CVE-2024-26445 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php |
CVE-2024-26352 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php |
CVE-2024-26351 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php |
CVE-2024-26350 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_contact_form_settings.php |
CVE-2024-26349 | Medium | 4.3 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php |
CVE-2024-23094 | High | 8.8 | 2024-02-22 | Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php |
CVE-2024-24837 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joo… |
CVE-2024-24802 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9. |
CVE-2024-24798 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10. |
CVE-2024-25905 | Medium | 5.4 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18. |
CVE-2024-25904 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and Ti… |
CVE-2024-24876 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12. |
CVE-2024-24872 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5. |
CVE-2024-24849 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: fr… |
CVE-2024-24843 | High | 7.1 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: f… |
CVE-2024-1501 | Medium | 4.7 | 2024-02-21 | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incor… |
CVE-2023-50923 | Medium | 4.3 | 2024-02-21 | In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allo… |
CVE-2021-29050 | High | 8.8 | 2024-02-20 | Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before… |
CVE-2023-47635 | Medium | 4.5 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabl… |
CVE-2024-25982 | Medium | 4.3 | 2024-02-19 | The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
CVE-2024-20986 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20933 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20718 | Medium | 4.3 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Secur… |
CVE-2024-23785 | Medium | 6.5 | 2024-02-14 | Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthen… |
CVE-2024-21381 | Medium | 6.8 | 2024-02-13 | Microsoft Azure Active Directory B2C Spoofing Vulnerability |
CVE-2024-25914 | Medium | 4.3 | 2024-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20. |
CVE-2023-52431 | High | 8.8 | 2024-02-13 | The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty coo… |
CVE-2023-52060 | Medium | 4.3 | 2024-02-13 | A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request. |
CVE-2023-6501 | Medium | 4.3 | 2024-02-12 | The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2023-6499 | Medium | 5.4 | 2024-02-12 | The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-24935 | Medium | 4.3 | 2024-02-12 | Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4. |
CVE-2024-24929 | Medium | 4.3 | 2024-02-12 | Cross-Site Request Forgery (CSRF) vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Contact Form: from n/a through 1.6. |
CVE-2024-24887 | Medium | 5.4 | 2024-02-12 | Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin… |
CVE-2024-24884 | Medium | 4.3 | 2024-02-12 | Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2. |
CVE-2024-24875 | Medium | 4.3 | 2024-02-12 | Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13. |
CVE-2024-25419 | High | 8.8 | 2024-02-11 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php. |
CVE-2024-25418 | High | 8.8 | 2024-02-11 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php. |
CVE-2024-25417 | High | 8.8 | 2024-02-11 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_translation.php. |
CVE-2023-50349 | Medium | 5.9 | 2024-02-09 | Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform m… |
CVE-2024-23319 | Low | 3.5 | 2024-02-09 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connec… |
CVE-2024-24819 | Medium | 5.3 | 2024-02-09 | icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for vario… |
CVE-2024-24820 | High | 8.3 | 2024-02-09 | Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monito… |
CVE-2023-47020 | High | 8.8 | 2024-02-08 | Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request… |
CVE-2024-0511 | Medium | 4.3 | 2024-02-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-24706 | Medium | 5.4 | 2024-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8. |
CVE-2024-20255 | High | 8.2 | 2024-02-07 | A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to… |
CVE-2024-20254 | Critical | 9.6 | 2024-02-07 | Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to… |
CVE-2024-20252 | Critical | 9.6 | 2024-02-07 | Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to… |
CVE-2023-38579 | High | 8.0 | 2024-02-06 | The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which… |
CVE-2024-24593 | Critical | 9.6 | 2024-02-06 | A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote att… |
CVE-2024-0859 | Medium | 4.3 | 2024-02-05 | The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or… |
CVE-2024-0796 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-0790 | Medium | 5.4 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… |
CVE-2024-0660 | Medium | 6.1 | 2024-02-05 | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2024-0428 | High | 7.1 | 2024-02-05 | The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect… |
CVE-2024-0374 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0373 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-24469 | High | 8.8 | 2024-02-05 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php. |
CVE-2024-24468 | High | 8.8 | 2024-02-05 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. |
CVE-2024-24470 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php component. |
CVE-2024-23831 | High | 7.5 | 2024-02-02 | LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick… |
CVE-2023-6676 | High | 8.8 | 2024-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This issue affects Cyber… |
CVE-2024-24524 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component. |
CVE-2024-1162 | Medium | 4.3 | 2024-02-02 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missi… |
CVE-2024-22859 | High | 8.8 | 2024-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the v… |
CVE-2024-22140 | High | 8.8 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0. |
CVE-2024-22136 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue aff… |
CVE-2024-22304 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2. |
CVE-2024-22291 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3. |
CVE-2024-22285 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3. |
CVE-2024-22143 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17. |
CVE-2024-22290 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom… |
CVE-2024-22287 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links… |
CVE-2024-22643 | Medium | 6.5 | 2024-01-30 | A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets. |
CVE-2023-51813 | Medium | 6.5 | 2024-01-30 | Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via th… |
CVE-2023-7074 | High | 8.8 | 2024-01-29 | The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2023-6946 | High | 8.8 | 2024-01-29 | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6633 | Medium | 4.3 | 2024-01-29 | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users per… |
CVE-2023-6503 | Medium | 5.4 | 2024-01-29 | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2023-6391 | High | 8.8 | 2024-01-29 | The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6390 | High | 8.8 | 2024-01-29 | The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-0667 | Medium | 5.4 | 2024-01-27 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-0880 | Medium | 4.3 | 2024-01-25 | A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/edit… |