CWE-352 · Cross-Site Request Forgery (CSRF) (page 56)
Page 56 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28191 | High | 8.8 | 2022-12-26 | The console in Togglz before 2.9.4 allows CSRF. |
CVE-2022-46491 | Medium | 6.5 | 2022-12-22 | A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Adminis… |
CVE-2020-36625 | Medium | 4.3 | 2022-12-22 | A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The man… |
CVE-2022-4646 | Medium | 6.5 | 2022-12-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4. |
CVE-2021-4275 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cros… |
CVE-2022-4633 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src… |
CVE-2021-4268 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-si… |
CVE-2020-36623 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The ma… |
CVE-2020-36622 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site… |
CVE-2022-4125 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well… |
CVE-2022-4124 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to d… |
CVE-2022-4024 | Medium | 6.5 | 2022-12-19 | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenti… |
CVE-2022-4604 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoint… |
CVE-2022-4564 | Medium | 4.3 | 2022-12-16 | A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fue… |
CVE-2022-3427 | High | 8.8 | 2022-12-15 | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect no… |
CVE-2022-46074 | High | 8.8 | 2022-12-14 | Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection. |
CVE-2022-46062 | Medium | 4.5 | 2022-12-13 | Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-46059 | Medium | 6.5 | 2022-12-13 | AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-41263 | Medium | 4.3 | 2022-12-12 | Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an authenticated non-… |
CVE-2022-3999 | High | 8.1 | 2022-12-12 | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such… |
CVE-2022-3946 | Medium | 6.5 | 2022-12-12 | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and… |
CVE-2022-3883 | Medium | 6.5 | 2022-12-12 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in… |
CVE-2022-3882 | Medium | 6.5 | 2022-12-12 | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in a… |
CVE-2022-3881 | Medium | 5.7 | 2022-12-12 | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not… |
CVE-2022-3880 | Medium | 6.5 | 2022-12-12 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation… |
CVE-2022-3879 | Medium | 6.5 | 2022-12-12 | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allo… |
CVE-2022-3853 | Medium | 5.4 | 2022-12-12 | Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including m… |
CVE-2022-45980 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet . |
CVE-2022-46688 | Medium | 6.5 | 2022-12-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerr… |
CVE-2022-41296 | Medium | 6.5 | 2022-12-12 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-45228 | Low | 3.5 | 2022-12-12 | Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page. |
CVE-2022-4397 | Medium | 4.3 | 2022-12-10 | A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/C… |
CVE-2022-4349 | Medium | 4.3 | 2022-12-08 | A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cro… |
CVE-2022-41622 | High | 8.8 | 2022-12-07 | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have r… |
CVE-2022-44849 | High | 8.8 | 2022-12-07 | A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account. |
CVE-2022-23475 | High | 8.8 | 2022-12-06 | daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross s… |
CVE-2022-3926 | Medium | 6.5 | 2022-12-05 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to mak… |
CVE-2022-45824 | Medium | 5.4 | 2022-12-05 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. |
CVE-2022-43470 | High | 7.3 | 2022-12-05 | Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W so… |
CVE-2022-35730 | Medium | 4.3 | 2022-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. |
CVE-2022-4220 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4219 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4218 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-45668 | Medium | 6.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-45667 | Medium | 6.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-45674 | Medium | 6.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-45673 | Medium | 6.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-41297 | Medium | 4.3 | 2022-12-01 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-40489 | High | 8.8 | 2022-12-01 | ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrati… |
CVE-2022-26366 | Medium | 5.4 | 2022-11-30 | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. |
CVE-2022-41413 | Medium | 4.3 | 2022-11-30 | perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Searc… |
CVE-2022-3898 | High | 8.8 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or i… |
CVE-2022-3747 | High | 8.8 | 2022-11-29 | The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validatio… |
CVE-2022-44937 | Medium | 6.5 | 2022-11-28 | Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module. |
CVE-2022-34654 | Medium | 4.3 | 2022-11-28 | Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress. |
CVE-2022-23044 | High | 8.8 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possi… |
CVE-2022-4090 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.ph… |
CVE-2021-29334 | High | 8.8 | 2022-11-23 | An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html |
CVE-2022-41927 | High | 7.4 | 2022-11-23 | XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The probl… |
CVE-2022-41925 | High | 8.8 | 2022-11-23 | A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment va… |
CVE-2022-41924 | Critical | 9.6 | 2022-11-23 | A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used… |
CVE-2022-45149 | Medium | 5.4 | 2022-11-23 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unne… |
CVE-2020-23592 | High | 8.8 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23590 | Medium | 6.5 | 2022-11-23 | A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cros… |
CVE-2020-23589 | Medium | 6.5 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23588 | Medium | 4.3 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23587 | Low | 3.1 | 2022-11-23 | A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to con… |
CVE-2020-23586 | Medium | 4.3 | 2022-11-23 | A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct… |
CVE-2020-23593 | Medium | 6.5 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cros… |
CVE-2020-23585 | High | 8.8 | 2022-11-23 | A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. T… |
CVE-2022-41919 | Medium | 4.2 | 2022-11-22 | Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking… |
CVE-2022-44737 | Medium | 6.5 | 2022-11-22 | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress. |
CVE-2020-23582 | Medium | 6.5 | 2022-11-21 | A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2022-3750 | Medium | 4.7 | 2022-11-21 | The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation. |
CVE-2022-45073 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. |
CVE-2022-44740 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-41685 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szá… |
CVE-2022-41634 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. |
CVE-2022-41615 | Medium | 6.1 | 2022-11-18 | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. |
CVE-2022-40695 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. |
CVE-2022-41805 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. |
CVE-2022-40687 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-40686 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-38075 | Medium | 6.1 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress. |
CVE-2022-40192 | High | 7.1 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-45072 | Medium | 4.3 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-45071 | Medium | 5.4 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-42246 | High | 8.8 | 2022-11-17 | Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account. |
CVE-2022-4021 | High | 8.8 | 2022-11-16 | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing… |
CVE-2022-4014 | Medium | 4.3 | 2022-11-16 | A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My… |
CVE-2022-4013 | Medium | 4.3 | 2022-11-16 | A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appoi… |
CVE-2022-45398 | Medium | 4.3 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster St… |
CVE-2022-45393 | Low | 3.5 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
CVE-2022-3240 | High | 8.8 | 2022-11-15 | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce v… |
CVE-2022-35613 | High | 8.8 | 2022-11-15 | Konker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-44389 | Medium | 6.5 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to… |
CVE-2022-44387 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module. |
CVE-2022-43323 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module. |
CVE-2022-43693 | High | 8.8 | 2022-11-14 | Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of… |
CVE-2022-3632 | Medium | 6.5 | 2022-11-14 | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users… |