CWE-352 · Cross-Site Request Forgery (CSRF) (page 42)
Page 42 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0624 | Medium | 5.3 | 2024-01-25 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-23902 | Medium | 4.3 | 2024-01-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an atta… |
CVE-2023-6625 | Medium | 4.3 | 2024-01-22 | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to mak… |
CVE-2024-0623 | Medium | 4.3 | 2024-01-20 | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing o… |
CVE-2023-47024 | High | 8.8 | 2024-01-20 | Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilitie… |
CVE-2023-47718 | Medium | 4.3 | 2024-01-19 | IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2024-22424 | High | 8.3 | 2024-01-19 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable t… |
CVE-2024-22819 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update. |
CVE-2024-22818 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save |
CVE-2024-22817 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte |
CVE-2024-22603 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link |
CVE-2024-22601 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save |
CVE-2024-22699 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save. |
CVE-2024-22593 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save |
CVE-2024-22592 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update |
CVE-2024-22591 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save. |
CVE-2024-22568 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del. |
CVE-2024-22416 | Critical | 9.6 | 2024-01-18 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session… |
CVE-2024-22715 | High | 8.8 | 2024-01-17 | Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php. |
CVE-2022-41990 | High | 7.1 | 2024-01-17 | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8. |
CVE-2023-5006 | Medium | 6.5 | 2024-01-17 | The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform… |
CVE-2024-20944 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-20942 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV). Supported versions that are affected ar… |
CVE-2024-20940 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authoring Flow). Supported versions that are a… |
CVE-2024-20934 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2023-7125 | Medium | 4.3 | 2024-01-16 | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which… |
CVE-2023-7083 | Medium | 5.4 | 2024-01-16 | The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2023-6292 | Medium | 4.3 | 2024-01-16 | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2023-3178 | Medium | 4.3 | 2024-01-16 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-0824 | Medium | 6.5 | 2024-01-16 | The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi… |
CVE-2022-3899 | High | 8.1 | 2024-01-16 | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowi… |
CVE-2022-1760 | Medium | 4.3 | 2024-01-16 | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1618 | Medium | 6.1 | 2024-01-16 | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in t… |
CVE-2022-1617 | Medium | 6.1 | 2024-01-16 | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in… |
CVE-2021-25117 | Medium | 4.8 | 2024-01-16 | The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratin… |
CVE-2021-24870 | Medium | 6.1 | 2024-01-16 | The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some… |
CVE-2024-0555 | Medium | 4.6 | 2024-01-16 | A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could lead another user into executin… |
CVE-2024-0522 | Medium | 4.3 | 2024-01-14 | A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=del… |
CVE-2023-51063 | High | 8.8 | 2024-01-13 | QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based Reflected Cross Site Scripting (XSS) vulnerability within the… |
CVE-2023-51949 | High | 8.8 | 2024-01-12 | Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role_controller |
CVE-2023-6244 | Medium | 6.5 | 2024-01-11 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4… |
CVE-2023-6242 | Medium | 6.5 | 2024-01-11 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4… |
CVE-2023-7048 | Low | 3.1 | 2024-01-11 | The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incor… |
CVE-2023-4248 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4247 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4246 | Medium | 4.3 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-6520 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5… |
CVE-2023-5448 | High | 8.8 | 2024-01-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to… |
CVE-2023-5455 | Medium | 6.5 | 2024-01-10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the use… |
CVE-2023-48258 | Medium | 5.5 | 2024-01-10 | The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session. |
CVE-2023-50932 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify ca… |
CVE-2023-50931 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can… |
CVE-2023-50930 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be m… |
CVE-2023-6788 | Medium | 5.4 | 2024-01-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This i… |
CVE-2023-52074 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte. |
CVE-2023-52073 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte. |
CVE-2023-52072 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte. |
CVE-2023-52216 | Medium | 4.3 | 2024-01-08 | Cross-Site Request Forgery (CSRF) vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through… |
CVE-2023-52200 | Critical | 9.6 | 2024-01-08 | Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Mem… |
CVE-2023-6845 | High | 8.8 | 2024-01-08 | The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2023-6532 | High | 8.8 | 2024-01-08 | The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2023-6529 | Medium | 6.1 | 2024-01-08 | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the pl… |
CVE-2023-52222 | Medium | 4.3 | 2024-01-08 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2. |
CVE-2023-52122 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. |
CVE-2023-52121 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load… |
CVE-2023-52120 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimat… |
CVE-2023-52119 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This… |
CVE-2023-51678 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a t… |
CVE-2023-51673 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu.This issue affects Stylish Pric… |
CVE-2023-51668 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through… |
CVE-2023-51539 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a thro… |
CVE-2023-51538 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Suppor… |
CVE-2023-51535 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam p… |
CVE-2023-52149 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0. |
CVE-2023-52145 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21. |
CVE-2023-52136 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feed… |
CVE-2023-52130 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31. |
CVE-2023-52129 | Medium | 6.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. |
CVE-2023-52128 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects Whi… |
CVE-2023-52127 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/… |
CVE-2023-52123 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10. |
CVE-2023-52184 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board… |
CVE-2023-52150 | High | 8.8 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a befo… |
CVE-2023-6493 | Medium | 4.3 | 2024-01-05 | The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… |
CVE-2023-6984 | Medium | 5.3 | 2024-01-03 | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2023-6980 | Medium | 4.3 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2018-25096 | Medium | 4.3 | 2023-12-30 | A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects som… |
CVE-2023-51545 | Critical | 9.6 | 2023-12-29 | Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitme… |
CVE-2023-51378 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder.This issue affects Rise Blocks – A Complete Gute… |
CVE-2023-51358 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms: from n/a through… |
CVE-2023-51354 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Ev… |
CVE-2023-50902 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1. |
CVE-2023-50878 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1. |
CVE-2023-51402 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery… |
CVE-2023-50873 | Medium | 4.3 | 2023-12-28 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through… |
CVE-2023-50858 | Medium | 5.4 | 2023-12-28 | Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This… |
CVE-2012-10017 | Medium | 4.3 | 2023-12-26 | A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The man… |
CVE-2023-46699 | Medium | 4.3 | 2023-12-26 | Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page whil… |
CVE-2023-48652 | Medium | 4.3 | 2023-12-25 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin u… |
CVE-2023-7092 | Medium | 4.3 | 2023-12-24 | A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_… |