CWE-352 · Cross-Site Request Forgery (CSRF) (page 53)
Page 53 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22689 | Medium | 4.6 | 2023-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions. |
CVE-2022-47134 | Medium | 4.3 | 2023-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions. |
CVE-2023-2736 | High | 7.5 | 2023-05-20 | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validat… |
CVE-2023-2717 | Medium | 5.4 | 2023-05-20 | The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validat… |
CVE-2023-27430 | Medium | 5.4 | 2023-05-18 | Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions. |
CVE-2023-27423 | Medium | 5.4 | 2023-05-18 | Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions. |
CVE-2023-25698 | Medium | 5.4 | 2023-05-18 | Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions. |
CVE-2023-2608 | Low | 3.1 | 2023-05-17 | The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order para… |
CVE-2023-2528 | Medium | 5.4 | 2023-05-17 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing… |
CVE-2023-2631 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-2195 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-33006 | Medium | 5.4 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker'… |
CVE-2023-33003 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics. |
CVE-2023-32998 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and s… |
CVE-2023-32995 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request wi… |
CVE-2023-32991 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an a… |
CVE-2023-32989 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-32987 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified L… |
CVE-2023-32980 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified j… |
CVE-2023-32978 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specif… |
CVE-2023-0763 | Medium | 4.3 | 2023-05-15 | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to… |
CVE-2023-28361 | Medium | 6.5 | 2023-05-11 | A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by… |
CVE-2023-2444 | High | 7.1 | 2023-05-11 | A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an at… |
CVE-2022-45846 | Medium | 5.4 | 2023-05-10 | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions. |
CVE-2023-27889 | High | 8.8 | 2023-05-10 | Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentic… |
CVE-2023-25832 | High | 8.8 | 2023-05-09 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user in… |
CVE-2020-23363 | High | 8.8 | 2023-05-09 | Cross Site Request Forgery (CSRF) vulnerability found in Verytops Verydows all versions that allows an attacker to execute arbitrary code via a crafted script. |
CVE-2023-0522 | Medium | 6.5 | 2023-05-08 | The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow atta… |
CVE-2020-36065 | High | 8.8 | 2023-05-08 | Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admin_save. |
CVE-2020-22334 | Medium | 6.5 | 2023-05-08 | Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.ph… |
CVE-2020-18131 | High | 8.8 | 2023-05-08 | Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary account via a crafted req… |
CVE-2023-2552 | High | 8.8 | 2023-05-05 | Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1. |
CVE-2023-1965 | Medium | 6.8 | 2023-05-03 | An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all version… |
CVE-2023-25967 | Medium | 4.3 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions. |
CVE-2023-23790 | High | 7.1 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions. |
CVE-2023-22691 | Medium | 4.3 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions. |
CVE-2023-2474 | Medium | 4.3 | 2023-05-02 | A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site requ… |
CVE-2023-29815 | High | 8.8 | 2023-04-28 | mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-2307 | Medium | 4.7 | 2023-04-26 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0. |
CVE-2022-40724 | Medium | 6.4 | 2023-04-25 | The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. |
CVE-2023-26841 | Medium | 6.5 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logg… |
CVE-2023-26840 | Medium | 5.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. |
CVE-2023-26839 | Medium | 4.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. |
CVE-2023-1414 | Medium | 4.3 | 2023-04-24 | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated us… |
CVE-2023-31061 | High | 8.8 | 2023-04-24 | Repetier Server through 1.4.10 does not have CSRF protection. |
CVE-2023-23879 | Medium | 4.3 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions. |
CVE-2023-22686 | Medium | 5.4 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions. |
CVE-2022-45080 | Medium | 5.4 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions. |
CVE-2022-45074 | Medium | 4.3 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions. |
CVE-2022-4944 | Medium | 4.3 | 2023-04-22 | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality… |
CVE-2023-29020 | Medium | 6.5 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fas… |
CVE-2023-2228 | Medium | 6.8 | 2023-04-21 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-30616 | Medium | 6.5 | 2023-04-20 | Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing no… |
CVE-2023-27495 | Medium | 5.3 | 2023-04-20 | @fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection lib… |
CVE-2023-29213 | Critical | 9.0 | 2023-04-17 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.platform:xwiki-plat… |
CVE-2023-30474 | Medium | 4.3 | 2023-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions. |
CVE-2018-17451 | High | 8.8 | 2023-04-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request F… |
CVE-2023-30529 | Medium | 4.3 | 2023-04-12 | Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database. |
CVE-2023-30525 | High | 8.8 | 2023-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL usin… |
CVE-2023-25411 | Medium | 4.3 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2020-19803 | High | 8.8 | 2023-04-11 | Cross Site Request Forgery vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the background system settings. |
CVE-2023-26845 | Medium | 4.3 | 2023-04-11 | A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. |
CVE-2023-27520 | Medium | 6.5 | 2023-04-11 | Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the aut… |
CVE-2012-10012 | Medium | 4.3 | 2023-04-10 | A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcb… |
CVE-2012-10010 | Medium | 4.3 | 2023-04-09 | A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file… |
CVE-2013-10025 | Medium | 4.3 | 2023-04-08 | A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the… |
CVE-2023-1937 | Medium | 4.3 | 2023-04-07 | A vulnerability, which was classified as problematic, was found in zhenfeng13 My-Blog. Affected is an unknown function of the file /admin/configurations/userIn… |
CVE-2023-1927 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1926 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1925 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1924 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1923 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1922 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1921 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1920 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1919 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-1918 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorr… |
CVE-2023-29008 | High | 8.8 | 2023-04-06 | The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for… |
CVE-2023-23801 | Medium | 4.3 | 2023-04-06 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions. |
CVE-2022-46793 | Medium | 5.4 | 2023-04-06 | Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions. |
CVE-2022-4941 | Medium | 6.3 | 2023-04-05 | The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on va… |
CVE-2023-20130 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2022-4938 | Medium | 6.3 | 2023-04-05 | The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks… |
CVE-2022-4936 | Medium | 6.3 | 2023-04-05 | The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on v… |
CVE-2023-1871 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1870 | Medium | 4.3 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1867 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1866 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-0480 | High | 8.8 | 2023-04-04 | VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application i… |
CVE-2023-29003 | High | 8.8 | 2023-04-04 | SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.j… |
CVE-2020-19278 | High | 8.8 | 2023-04-04 | Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter. |
CVE-2023-28848 | Medium | 4.8 | 2023-04-04 | user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allo… |
CVE-2022-41633 | Medium | 5.4 | 2023-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versi… |
CVE-2023-1330 | Medium | 6.5 | 2023-04-03 | The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects v… |
CVE-2023-0820 | High | 8.8 | 2023-04-03 | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privileg… |
CVE-2023-28676 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freest… |
CVE-2023-28674 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously… |
CVE-2023-28671 | Medium | 4.3 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-s… |
CVE-2022-42447 | Critical | 9.6 | 2023-04-02 | HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into… |
CVE-2023-23861 | Medium | 5.4 | 2023-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions. |