CWE-352 · Cross-Site Request Forgery (CSRF) (page 57)
Page 57 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3538 | Medium | 6.5 | 2022-11-14 | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated user… |
CVE-2022-2449 | Medium | 6.5 | 2022-11-14 | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowi… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-45130 | Medium | 6.5 | 2022-11-10 | Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk… |
CVE-2022-43031 | High | 8.8 | 2022-11-09 | DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin… |
CVE-2022-43488 | Medium | 5.4 | 2022-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration. |
CVE-2022-44741 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress. |
CVE-2022-43491 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import. |
CVE-2022-43481 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal. |
CVE-2022-41136 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on Word… |
CVE-2022-40632 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. |
CVE-2022-40128 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download. |
CVE-2022-38137 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. |
CVE-2022-32587 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. |
CVE-2022-27855 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. |
CVE-2022-30694 | Medium | 6.5 | 2022-11-08 | The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the a… |
CVE-2022-3537 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uplo… |
CVE-2022-3536 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path give… |
CVE-2022-3489 | Medium | 5.3 | 2022-11-07 | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauth… |
CVE-2022-3451 | Medium | 4.3 | 2022-11-07 | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role… |
CVE-2022-2387 | Medium | 4.3 | 2022-11-07 | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be… |
CVE-2022-38660 | High | 8.3 | 2022-11-04 | HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to… |
CVE-2022-20961 | High | 8.8 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2022-44627 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps. |
CVE-2022-40131 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings. |
CVE-2022-36404 | Medium | 5.4 | 2022-11-03 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions. |
CVE-2022-30608 | High | 8.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2022-25952 | Medium | 4.3 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. |
CVE-2022-42751 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This… |
CVE-2022-3852 | High | 8.8 | 2022-11-03 | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect n… |
CVE-2022-3776 | High | 8.8 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… |
CVE-2022-40291 | High | 8.8 | 2022-10-31 | The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site… |
CVE-2022-3419 | Medium | 6.5 | 2022-10-31 | The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subsc… |
CVE-2022-40488 | Medium | 6.5 | 2022-10-31 | ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-43340 | High | 8.8 | 2022-10-27 | A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular… |
CVE-2022-41996 | High | 8.8 | 2022-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/acti… |
CVE-2022-2762 | Medium | 6.5 | 2022-10-25 | The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes v… |
CVE-2022-42199 | High | 8.8 | 2022-10-20 | Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List. |
CVE-2022-43418 | Medium | 4.3 | 2022-10-19 | A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2022-43408 | Medium | 6.5 | 2022-10-19 | Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipel… |
CVE-2022-43407 | High | 8.8 | 2022-10-19 | Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is use… |
CVE-2022-41500 | High | 8.8 | 2022-10-18 | EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Re… |
CVE-2022-3585 | Medium | 4.3 | 2022-10-18 | A vulnerability classified as problematic has been found in SourceCodester Simple Cold Storage Management System 1.0. Affected is an unknown function of the fi… |
CVE-2022-3582 | Medium | 4.3 | 2022-10-18 | A vulnerability has been found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2020-8976 | Critical | 9.6 | 2022-10-17 | The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permiss… |
CVE-2022-23771 | High | 8.0 | 2022-10-17 | This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of valid… |
CVE-2022-3151 | Medium | 4.3 | 2022-10-17 | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in ad… |
CVE-2022-3149 | Medium | 6.1 | 2022-10-17 | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a… |
CVE-2022-3126 | Medium | 4.3 | 2022-10-17 | The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in user… |
CVE-2022-3082 | Medium | 6.5 | 2022-10-17 | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users… |
CVE-2022-42070 | High | 8.8 | 2022-10-14 | Online Birth Certificate Management System version 1.0 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-35611 | Medium | 4.3 | 2022-10-13 | A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards. |
CVE-2022-41489 | High | 8.1 | 2022-10-13 | WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affe… |
CVE-2022-41475 | High | 8.8 | 2022-10-13 | RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account. |
CVE-2022-41474 | Medium | 6.5 | 2022-10-13 | RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account. |
CVE-2022-34020 | High | 8.8 | 2022-10-13 | Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin us… |
CVE-2022-42087 | Medium | 6.5 | 2022-10-12 | Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-42086 | Medium | 6.5 | 2022-10-12 | Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode. |
CVE-2022-42078 | Medium | 6.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-42077 | Medium | 6.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-38086 | Medium | 5.4 | 2022-10-11 | Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change. |
CVE-2021-36915 | Medium | 4.2 | 2022-10-11 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the opti… |
CVE-2022-32175 | Medium | 5.4 | 2022-10-11 | In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attac… |
CVE-2022-40180 | Medium | 5.3 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40179 | High | 8.1 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-3208 | Medium | 6.5 | 2022-10-10 | The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and… |
CVE-2022-3154 | High | 7.1 | 2022-10-10 | The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gr… |
CVE-2022-2350 | Medium | 5.3 | 2022-10-10 | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attacker… |
CVE-2022-22493 | High | 8.8 | 2022-10-07 | IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-F… |
CVE-2022-2986 | High | 8.8 | 2022-10-06 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. |
CVE-2022-2783 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
CVE-2022-2839 | Medium | 5.4 | 2022-10-03 | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated use… |
CVE-2022-39268 | High | 8.1 | 2022-09-30 | ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to b… |
CVE-2021-36855 | Medium | 6.1 | 2022-09-30 | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress. |
CVE-2021-36854 | Medium | 5.4 | 2022-09-30 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress. |
CVE-2020-35675 | High | 8.8 | 2022-09-29 | BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable end… |
CVE-2022-3057 | Medium | 6.5 | 2022-09-26 | Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2022-3119 | High | 7.5 | 2022-09-26 | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticate… |
CVE-2022-3098 | Medium | 4.3 | 2022-09-26 | The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-3025 | Medium | 5.4 | 2022-09-26 | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin… |
CVE-2022-3024 | Medium | 5.4 | 2022-09-26 | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as… |
CVE-2022-2987 | High | 7.5 | 2022-09-26 | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (whi… |
CVE-2022-2405 | Medium | 4.3 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subs… |
CVE-2021-24890 | High | 8.8 | 2022-09-26 | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and… |
CVE-2022-40132 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. |
CVE-2022-38704 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. |
CVE-2022-38454 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. |
CVE-2022-38079 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress. |
CVE-2022-38470 | Medium | 4.3 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. |
CVE-2022-36417 | Medium | 6.1 | 2022-09-23 | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. |
CVE-2022-40671 | Medium | 4.3 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress. |
CVE-2022-38085 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. |
CVE-2022-36388 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. |
CVE-2022-38095 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. |
CVE-2022-36798 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. |
CVE-2022-3274 | Low | 3.5 | 2022-09-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-3267 | Medium | 4.3 | 2022-09-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-3233 | Medium | 4.3 | 2022-09-21 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-40219 | Medium | 5.4 | 2022-09-21 | Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. |
CVE-2022-41253 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server… |