CWE-352 · Cross-Site Request Forgery (CSRF) (page 5)
Page 5 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8423 | Medium | 4.3 | 2026-05-20 | The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to mis… |
CVE-2026-8420 | Medium | 6.1 | 2026-05-20 | The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing… |
CVE-2026-8419 | Medium | 4.3 | 2026-05-20 | The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
CVE-2026-8418 | Medium | 4.3 | 2026-05-20 | The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect… |
CVE-2026-6452 | Medium | 4.3 | 2026-05-20 | The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing o… |
CVE-2026-6401 | Medium | 4.3 | 2026-05-20 | The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verific… |
CVE-2026-6400 | Medium | 4.3 | 2026-05-20 | The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due t… |
CVE-2026-6395 | Medium | 6.1 | 2026-05-20 | The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2… |
CVE-2026-6391 | Medium | 6.1 | 2026-05-20 | The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0… |
CVE-2026-8604 | High | 8.8 | 2026-05-19 | In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in u… |
CVE-2018-25337 | Medium | 4.3 | 2026-05-17 | Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated user… |
CVE-2018-25336 | Medium | 5.3 | 2026-05-17 | jCart for OpenCart 2.3.0.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information without authentication… |
CVE-2018-25334 | Medium | 5.4 | 2026-05-17 | Zechat 1.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections… |
CVE-2018-25327 | Medium | 5.3 | 2026-05-17 | Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token valid… |
CVE-2018-25321 | Medium | 4.3 | 2026-05-17 | TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by c… |
CVE-2021-47976 | High | 8.8 | 2026-05-16 | TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the pl… |
CVE-2020-37241 | Medium | 5.3 | 2026-05-16 | bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into… |
CVE-2026-45317 | Medium | 4.6 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forge… |
CVE-2026-45773 | Medium | 6.5 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did… |
CVE-2026-8425 | Medium | 4.3 | 2026-05-15 | The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorre… |
CVE-2026-28761 | High | 8.1 | 2026-05-15 | Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious… |
CVE-2026-5365 | Medium | 4.3 | 2026-05-14 | The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verifica… |
CVE-2026-4527 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2025-27851 | Critical | 9.3 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes W… |
CVE-2026-44364 | | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the M… | |
CVE-2026-41255 | Medium | 6.1 | 2026-05-13 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or una… |
CVE-2026-40703 | Medium | 5.4 | 2026-05-13 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End… |
CVE-2020-37217 | Medium | 4.3 | 2026-05-13 | Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrato… |
CVE-2026-44548 | High | 8.1 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete… |
CVE-2026-44347 | Medium | 5.8 | 2026-05-12 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it pos… |
CVE-2026-42289 | High | 8.8 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_… |
CVE-2026-30807 | High | 8.8 | 2026-05-12 | Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 thro… |
CVE-2026-7616 | Medium | 4.3 | 2026-05-12 | The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorr… |
CVE-2026-7562 | Medium | 4.3 | 2026-05-12 | The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a… |
CVE-2026-7561 | Medium | 6.1 | 2026-05-12 | The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missi… |
CVE-2026-6932 | Medium | 4.3 | 2026-05-12 | The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to miss… |
CVE-2026-6710 | Medium | 4.3 | 2026-05-12 | The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or… |
CVE-2026-45430 | High | 7.1 | 2026-05-12 | The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks. |
CVE-2026-0502 | Medium | 5.4 | 2026-05-12 | Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send uninte… |
CVE-2026-44695 | Medium | 5.8 | 2026-05-11 | Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned… |
CVE-2026-43877 | Medium | 5.4 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a… |
CVE-2026-38566 | High | 8.1 | 2026-05-11 | HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /cand… |
CVE-2022-50955 | Medium | 4.3 | 2026-05-10 | WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by cra… |
CVE-2021-47953 | Medium | 4.3 | 2026-05-10 | OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/… |
CVE-2021-47946 | Medium | 5.3 | 2026-05-10 | OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim accou… |
CVE-2026-8194 | Medium | 4.3 | 2026-05-09 | A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component… |
CVE-2026-42286 | | 2026-05-08 | Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authent… | |
CVE-2026-42190 | Medium | 5.3 | 2026-05-08 | RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no… |
CVE-2026-5791 | Medium | 6.5 | 2026-05-07 | Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery. This issue affects D… |
CVE-2026-28201 | High | 7.8 | 2026-05-07 | An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimat… |
CVE-2026-27415 | Medium | 4.3 | 2026-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5. |
CVE-2025-68604 | Medium | 5.4 | 2026-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3. |
CVE-2026-41663 | Low | 3.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup… |
CVE-2026-40326 | | 2026-05-06 | Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in `csettings.cfc` does not properly valid… | |
CVE-2026-40325 | | 2026-05-06 | Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF… | |
CVE-2026-40309 | | 2026-05-06 | Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for t… | |
CVE-2026-40174 | | 2026-05-06 | Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-… | |
CVE-2026-8022 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2026-6702 | Medium | 6.1 | 2026-05-05 | The Publish 2 Ping.fm plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inc… |
CVE-2026-6701 | Medium | 4.3 | 2026-05-05 | The addfreespace plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.3. This is due to missing or incorr… |
CVE-2026-6700 | Medium | 4.3 | 2026-05-05 | The DX Sources plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrec… |
CVE-2026-42091 | Medium | 6.5 | 2026-05-04 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added… |
CVE-2026-3772 | High | 8.8 | 2026-05-01 | The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce veri… |
CVE-2026-3140 | Medium | 4.3 | 2026-05-01 | The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed n… |
CVE-2026-36960 | High | 8.8 | 2026-04-30 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF… |
CVE-2026-36956 | High | 8.8 | 2026-04-30 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to im… |
CVE-2018-25310 | Medium | 4.3 | 2026-04-29 | VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitr… |
CVE-2018-25298 | Medium | 5.3 | 2026-04-29 | Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targe… |
CVE-2026-42645 | Medium | 4.3 | 2026-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to… |
CVE-2026-38934 | High | 8.8 | 2026-04-27 | Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sens… |
CVE-2026-7108 | Medium | 4.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-s… |
CVE-2026-41425 | Medium | 5.4 | 2026-04-24 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integra… |
CVE-2026-3565 | Medium | 4.3 | 2026-04-24 | The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verific… |
CVE-2026-41317 | High | 7.5 | 2026-04-24 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.creat… |
CVE-2026-27841 | High | 8.1 | 2026-04-24 | A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF)… |
CVE-2026-41347 | High | 7.1 | 2026-04-23 | OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery… |
CVE-2026-40471 | Critical | 9.6 | 2026-04-23 | hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, pos… |
CVE-2026-4922 | High | 8.1 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2025-58922 | Medium | 4.3 | 2026-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2. |
CVE-2026-6396 | Medium | 4.3 | 2026-04-22 | The Fast & Fancy Filter – 3F plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing non… |
CVE-2026-6294 | Medium | 4.3 | 2026-04-22 | The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is due to missing nonce… |
CVE-2026-4140 | Medium | 4.3 | 2026-04-22 | The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to miss… |
CVE-2026-4139 | Medium | 4.3 | 2026-04-22 | The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence… |
CVE-2026-4138 | Medium | 4.3 | 2026-04-22 | The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing n… |
CVE-2026-4133 | Medium | 4.3 | 2026-04-22 | The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing non… |
CVE-2026-4131 | Medium | 6.1 | 2026-04-22 | The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the se… |
CVE-2026-4121 | Medium | 4.3 | 2026-04-22 | The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing nonce validatio… |
CVE-2026-4118 | Medium | 4.3 | 2026-04-22 | The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing… |
CVE-2026-4090 | Medium | 6.1 | 2026-04-22 | The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce ver… |
CVE-2026-40929 | Medium | 5.4 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comme… |
CVE-2026-40928 | Medium | 5.4 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$… |
CVE-2026-40926 | High | 7.1 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categor… |
CVE-2026-40925 | High | 8.3 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists doz… |
CVE-2026-40883 | High | 8.1 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET… |
CVE-2026-41194 | Medium | 5.4 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented as `GET /mailbox/oau… |
CVE-2026-31014 | Medium | 6.3 | 2026-04-21 | Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The affected endpoint processes state-changing requests withou… |
CVE-2026-6777 | Medium | 5.3 | 2026-04-21 | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6755 | Medium | 6.5 | 2026-04-21 | Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6589 | Medium | 4.3 | 2026-04-20 | A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middleware of the file server.py. The manipula… |