CWE-352 · Cross-Site Request Forgery (CSRF) (page 6)
Page 6 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40948 | Medium | 5.4 | 2026-04-18 | The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-ca… |
CVE-2026-40581 | High | 8.1 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, ir… |
CVE-2026-40458 | Medium | 6.5 | 2026-04-17 | PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will autom… |
CVE-2026-6451 | Medium | 4.3 | 2026-04-17 | The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. This is due to missi… |
CVE-2025-15635 | Medium | 4.3 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forgery.This issue affe… |
CVE-2025-53444 | Medium | 4.3 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in DeluxeThemes Userpro userpro allows Cross Site Request Forgery.This issue affects Userpro: from n/a through… |
CVE-2026-1852 | Medium | 6.1 | 2026-04-15 | The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due… |
CVE-2026-40764 | High | 8.1 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contac… |
CVE-2026-28741 | Medium | 6.8 | 2026-04-15 | Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which… |
CVE-2026-4091 | Medium | 6.1 | 2026-04-15 | The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verif… |
CVE-2026-4002 | Medium | 4.3 | 2026-04-15 | The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missing nonce validatio… |
CVE-2026-6293 | Medium | 4.3 | 2026-04-15 | The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in version 1.0. This… |
CVE-2026-40041 | Medium | 4.3 | 2026-04-13 | Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting… |
CVE-2019-25708 | Medium | 4.3 | 2026-04-12 | Heatmiser Wifi Thermostat 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials by tricking authent… |
CVE-2019-25693 | High | 7.1 | 2026-04-12 | ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2026-6109 | Medium | 4.3 | 2026-04-12 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minec… |
CVE-2026-1924 | Medium | 4.3 | 2026-04-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing no… |
CVE-2026-39848 | Medium | 6.5 | 2026-04-09 | Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF prote… |
CVE-2025-70811 | Medium | 4.3 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management… |
CVE-2025-70810 | High | 8.8 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticatio… |
CVE-2026-5918 | Medium | 4.3 | 2026-04-08 | Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2026-34721 | Medium | 6.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook… |
CVE-2026-0811 | Medium | 5.4 | 2026-04-08 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to mis… |
CVE-2026-1673 | Medium | 4.3 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-1672 | Medium | 6.5 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-39710 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Them… |
CVE-2026-39671 | High | 7.1 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Reque… |
CVE-2026-39641 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a thro… |
CVE-2026-39640 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a throu… |
CVE-2026-39635 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine… |
CVE-2026-39634 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfol… |
CVE-2026-39633 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Re… |
CVE-2026-39632 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a th… |
CVE-2026-39621 | High | 8.8 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: f… |
CVE-2026-39620 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appoint… |
CVE-2026-39619 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: fro… |
CVE-2026-39618 | Medium | 4.3 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <=… |
CVE-2026-39617 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from… |
CVE-2026-39603 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Pho… |
CVE-2026-4141 | Medium | 4.3 | 2026-04-08 | The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce… |
CVE-2026-3499 | High | 8.8 | 2026-04-08 | The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1… |
CVE-2026-4401 | Medium | 5.4 | 2026-04-08 | The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class… |
CVE-2026-39371 | High | 8.1 | 2026-04-07 | RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests… |
CVE-2026-34904 | High | 7.5 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Soci… |
CVE-2026-34896 | High | 7.5 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue af… |
CVE-2026-35181 | Medium | 4.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not valida… |
CVE-2026-35180 | Medium | 4.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lac… |
CVE-2026-5624 | Medium | 4.3 | 2026-04-06 | A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in… |
CVE-2019-25682 | Medium | 4.3 | 2026-04-05 | CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML… |
CVE-2026-5572 | Medium | 4.3 | 2026-04-05 | A security flaw has been discovered in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This affects an unknown function. Performing a manipulation results in cro… |
CVE-2016-20054 | Medium | 4.3 | 2026-04-04 | Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. At… |
CVE-2016-20053 | Medium | 5.3 | 2026-04-04 | Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking aut… |
CVE-2016-20051 | Medium | 5.3 | 2026-04-04 | Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting… |
CVE-2026-34228 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The… |
CVE-2025-36375 | Medium | 6.5 | 2026-04-01 | IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 th… |
CVE-2026-34749 | Medium | 5.4 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the… |
CVE-2026-5283 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-34613 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or… |
CVE-2026-34611 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML… |
CVE-2026-34394 | High | 8.1 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF tok… |
CVE-2026-34384 | Medium | 4.5 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registratio… |
CVE-2026-34383 | Medium | 4.3 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST paramete… |
CVE-2026-34382 | Medium | 4.6 | 2026-03-31 | Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently dele… |
CVE-2026-3191 | Medium | 5.4 | 2026-03-31 | The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorr… |
CVE-2026-33373 | High | 8.8 | 2026-03-30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the i… |
CVE-2026-4315 | Medium | 6.5 | 2026-03-30 | A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condit… |
CVE-2026-4971 | Medium | 4.3 | 2026-03-27 | A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forge… |
CVE-2026-4968 | Medium | 4.3 | 2026-03-27 | A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can… |
CVE-2026-4984 | High | 8.2 | 2026-03-27 | The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches u… |
CVE-2026-4393 | Medium | 4.3 | 2026-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 be… |
CVE-2026-1032 | Medium | 4.3 | 2026-03-26 | The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonc… |
CVE-2025-36422 | Medium | 4.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request forgery which could allo… |
CVE-2026-3857 | High | 8.1 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have al… |
CVE-2026-27659 | Medium | 4.6 | 2026-03-25 | Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_contr… |
CVE-2026-3211 | Medium | 4.3 | 2026-03-25 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by… |
CVE-2025-40841 | Medium | 4.3 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized… |
CVE-2026-29839 | High | 8.8 | 2026-03-24 | DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php. |
CVE-2026-33252 | High | 7.1 | 2026-03-24 | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` re… |
CVE-2026-33649 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parame… |
CVE-2026-33507 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload a… |
CVE-2026-4590 | Low | 3.1 | 2026-03-23 | A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/cont… |
CVE-2026-31849 | Medium | 6.5 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools an… |
CVE-2026-4143 | Medium | 4.3 | 2026-03-21 | The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to mi… |
CVE-2026-3332 | Medium | 4.3 | 2026-03-21 | The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to… |
CVE-2026-3331 | Medium | 4.3 | 2026-03-21 | The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing… |
CVE-2026-2723 | Medium | 6.1 | 2026-03-21 | The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce vali… |
CVE-2026-1503 | Medium | 4.3 | 2026-03-21 | The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0… |
CVE-2026-1393 | Medium | 4.3 | 2026-03-21 | The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2026-1392 | Medium | 4.3 | 2026-03-21 | The SR WP Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing nonce… |
CVE-2026-1390 | Medium | 4.3 | 2026-03-21 | The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce… |
CVE-2026-1378 | Medium | 4.3 | 2026-03-21 | The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce… |
CVE-2025-14037 | High | 8.1 | 2026-03-21 | The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This i… |
CVE-2026-32989 | High | 8.8 | 2026-03-20 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests… |
CVE-2026-33372 | Medium | 5.4 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper… |
CVE-2024-32537 | High | 7.1 | 2026-03-20 | Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from… |
CVE-2026-32816 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_… |
CVE-2026-32755 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.6 and below, the save_membership action in modules/profile/profile_function.php saves chang… |
CVE-2026-4068 | Medium | 4.3 | 2026-03-19 | The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to mis… |
CVE-2025-55046 | High | 8.1 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a sim… |
CVE-2025-55045 | High | 7.1 | 2026-03-18 | The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.up… |