CWE-352 · Cross-Site Request Forgery (CSRF) (page 54)
Page 54 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38077 | Medium | 4.3 | 2023-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin… |
CVE-2023-1509 | High | 8.8 | 2023-03-29 | The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on… |
CVE-2023-28718 | High | 7.1 | 2023-03-28 | Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may al… |
CVE-2023-1089 | Medium | 4.3 | 2023-03-27 | The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate ar… |
CVE-2023-0498 | Medium | 4.3 | 2023-03-27 | The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0497 | Medium | 4.3 | 2023-03-27 | The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0336 | Medium | 6.5 | 2023-03-27 | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscr… |
CVE-2023-0335 | Medium | 6.5 | 2023-03-27 | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachme… |
CVE-2022-30705 | Medium | 5.4 | 2023-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. |
CVE-2023-28335 | High | 8.8 | 2023-03-23 | The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk. |
CVE-2023-20113 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2023-0870 | High | 8.1 | 2023-03-22 | A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain… |
CVE-2022-4148 | Medium | 4.3 | 2023-03-20 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow an… |
CVE-2023-23721 | Medium | 4.3 | 2023-03-20 | Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions. |
CVE-2023-22678 | Medium | 5.4 | 2023-03-20 | Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions. |
CVE-2023-22681 | Medium | 4.3 | 2023-03-20 | Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions. |
CVE-2022-46867 | Medium | 4.3 | 2023-03-17 | Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version. |
CVE-2022-46854 | Medium | 5.4 | 2023-03-17 | Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions. |
CVE-2023-1472 | Medium | 6.3 | 2023-03-17 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2022-38063 | Medium | 5.4 | 2023-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions. |
CVE-2023-25968 | Medium | 4.3 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8… |
CVE-2023-25709 | Medium | 5.4 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.11 versions. |
CVE-2023-25708 | Medium | 4.3 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions. |
CVE-2022-47427 | Medium | 5.4 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions. |
CVE-2023-27234 | Medium | 6.5 | 2023-03-15 | A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application. |
CVE-2023-24920 | Medium | 5.4 | 2023-03-14 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-27073 | Medium | 6.5 | 2023-03-14 | A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request. |
CVE-2022-47443 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions. |
CVE-2022-47422 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions. |
CVE-2022-47147 | Medium | 5.4 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Kesz1 Technologies ipBlockList plugin <= 1.0 versions. |
CVE-2022-47143 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG plugin <= 3.3.9 versions. |
CVE-2022-47141 | Medium | 5.4 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <= 2.3.15 versions. |
CVE-2022-47154 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2… |
CVE-2022-47163 | Low | 3.1 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versio… |
CVE-2022-47162 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin <= 36 versions. |
CVE-2022-47155 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin <= 1.8.5 versions. |
CVE-2023-25170 | Medium | 5.0 | 2023-03-13 | PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating u… |
CVE-2023-25973 | Medium | 5.4 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions. |
CVE-2023-23711 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions. |
CVE-2023-22700 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions. |
CVE-2023-25991 | Medium | 5.4 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions. |
CVE-2022-47440 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions. |
CVE-2022-47166 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions. |
CVE-2023-1346 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1345 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1344 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1343 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1342 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1341 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1340 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1205 | High | 8.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF prot… |
CVE-2023-27490 | High | 8.1 | 2023-03-09 | NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have be… |
CVE-2021-4333 | Medium | 6.5 | 2023-03-07 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrec… |
CVE-2020-36669 | High | 8.8 | 2023-03-07 | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is d… |
CVE-2022-4265 | High | 8.8 | 2023-03-06 | The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notic… |
CVE-2022-48309 | Medium | 4.3 | 2023-03-01 | A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. |
CVE-2022-47148 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss. |
CVE-2022-46806 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification. |
CVE-2022-46805 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactiva… |
CVE-2022-46798 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change. |
CVE-2022-46797 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 lead… |
CVE-2022-45804 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy c… |
CVE-2022-45068 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. |
CVE-2022-40198 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change. |
CVE-2022-38468 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration. |
CVE-2023-23984 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion. |
CVE-2023-23974 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit… |
CVE-2023-23973 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0. |
CVE-2023-27295 | Medium | 5.4 | 2023-02-28 | Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy p… |
CVE-2023-23983 | Medium | 5.4 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion. |
CVE-2023-23865 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change. |
CVE-2022-47612 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. |
CVE-2022-47179 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft. |
CVE-2023-24419 | High | 7.1 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions. |
CVE-2023-23992 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete. |
CVE-2022-43459 | Medium | 5.4 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. |
CVE-2023-1028 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-1068 | Medium | 4.3 | 2023-02-27 | The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to mi… |
CVE-2023-1033 | High | 8.8 | 2023-02-25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2021-34167 | High | 8.8 | 2023-02-24 | Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php. |
CVE-2023-1029 | Medium | 4.3 | 2023-02-24 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-0999 | Medium | 4.3 | 2023-02-24 | A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2022-1607 | Medium | 4.6 | 2023-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.Thi… |
CVE-2023-20011 | High | 8.8 | 2023-02-23 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly… |
CVE-2023-24415 | Medium | 5.4 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions. |
CVE-2023-0988 | Medium | 4.3 | 2023-02-23 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown proces… |
CVE-2023-24384 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions. |
CVE-2023-23659 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. |
CVE-2022-4386 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any use… |
CVE-2022-48320 | Medium | 5.4 | 2023-02-20 | Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new v… |
CVE-2015-10081 | Medium | 4.3 | 2023-02-20 | A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_lis… |
CVE-2023-25569 | Medium | 5.7 | 2023-02-20 | Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visi… |
CVE-2023-24388 | Medium | 4.3 | 2023-02-17 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions… |
CVE-2023-23899 | Medium | 4.3 | 2023-02-17 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation. |
CVE-2021-33396 | Medium | 6.5 | 2023-02-15 | Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via in… |
CVE-2023-23847 | Low | 3.5 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-23465 | Critical | 9.1 | 2023-02-15 | Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint. |
CVE-2023-25767 | High | 8.8 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-… |
CVE-2022-47373 | Medium | 6.4 | 2023-02-15 | Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget passwor… |
CVE-2022-47372 | High | 7.6 | 2023-02-15 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability… |