CWE-352 · Cross-Site Request Forgery (CSRF) (page 60)
Page 60 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29450 | Medium | 5.4 | 2022-06-15 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress. |
CVE-2022-29453 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update. |
CVE-2022-29441 | Medium | 4.3 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages. |
CVE-2022-29439 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides. |
CVE-2022-29437 | Medium | 5.4 | 2022-06-15 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress. |
CVE-2022-30930 | Medium | 4.3 | 2022-06-14 | Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). |
CVE-2022-30931 | Medium | 6.5 | 2022-06-14 | Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php. |
CVE-2022-1969 | High | 8.8 | 2022-06-13 | The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missin… |
CVE-2022-1749 | High | 8.8 | 2022-06-13 | The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/con… |
CVE-2022-1918 | High | 8.8 | 2022-06-13 | The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce valid… |
CVE-2022-1900 | High | 8.8 | 2022-06-13 | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on… |
CVE-2022-1793 | Medium | 4.3 | 2022-06-13 | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perf… |
CVE-2022-1792 | Medium | 5.4 | 2022-06-13 | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1791 | High | 8.1 | 2022-06-13 | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1790 | Medium | 6.5 | 2022-06-13 | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2022-1788 | Medium | 6.5 | 2022-06-13 | Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file an… |
CVE-2022-1787 | Medium | 5.4 | 2022-06-13 | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin c… |
CVE-2022-1781 | Medium | 5.4 | 2022-06-13 | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2022-1780 | Medium | 5.4 | 2022-06-13 | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1779 | High | 8.1 | 2022-06-13 | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1765 | High | 8.8 | 2022-06-13 | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server… |
CVE-2022-1764 | Medium | 5.4 | 2022-06-13 | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1763 | Medium | 5.4 | 2022-06-13 | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including… |
CVE-2022-1761 | Medium | 6.5 | 2022-06-13 | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, whi… |
CVE-2022-1759 | Medium | 5.4 | 2022-06-13 | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2022-1758 | High | 8.8 | 2022-06-13 | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1694 | Medium | 6.5 | 2022-06-13 | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logge… |
CVE-2022-1624 | Medium | 6.5 | 2022-06-13 | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1612 | Medium | 6.5 | 2022-06-13 | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1608 | Medium | 6.5 | 2022-06-13 | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a l… |
CVE-2022-1605 | Medium | 6.5 | 2022-06-13 | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2022-1594 | Medium | 4.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2021-25116 | Medium | 6.5 | 2022-06-13 | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the i… |
CVE-2017-20045 | High | 7.3 | 2022-06-13 | A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to c… |
CVE-2022-27174 | Medium | 4.3 | 2022-06-13 | Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authenti… |
CVE-2022-22479 | High | 8.8 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un… |
CVE-2021-44117 | High | 8.8 | 2022-06-10 | A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4. |
CVE-2017-20020 | Medium | 5.3 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this issue is some unknown functionalit… |
CVE-2022-30898 | Medium | 6.5 | 2022-06-09 | A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password. |
CVE-2019-25064 | Medium | 4.3 | 2022-06-09 | A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to… |
CVE-2022-1712 | Medium | 4.3 | 2022-06-08 | The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1709 | Medium | 4.3 | 2022-06-08 | The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers… |
CVE-2022-1695 | Medium | 4.3 | 2022-06-08 | The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged i… |
CVE-2022-1577 | Medium | 5.4 | 2022-06-08 | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attack… |
CVE-2022-1570 | Medium | 6.5 | 2022-06-08 | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authentica… |
CVE-2022-1424 | Medium | 6.5 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform vari… |
CVE-2022-1422 | Medium | 6.5 | 2022-06-08 | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetti… |
CVE-2022-1421 | Medium | 4.3 | 2022-06-08 | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings includ… |
CVE-2020-36534 | Medium | 4.3 | 2022-06-07 | A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation l… |
CVE-2022-29735 | High | 8.8 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2022-29647 | High | 8.8 | 2022-06-02 | An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |
CVE-2021-36890 | Medium | 4.3 | 2022-06-02 | Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. |
CVE-2020-20971 | High | 8.8 | 2022-06-02 | Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index. |
CVE-2022-31000 | Low | 2.3 | 2022-06-01 | solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (… |
CVE-2022-22361 | Medium | 6.5 | 2022-05-31 | IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Busine… |
CVE-2022-1611 | High | 8.8 | 2022-05-30 | The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF. |
CVE-2022-1589 | High | 7.5 | 2022-05-30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, wh… |
CVE-2022-1203 | Medium | 4.3 | 2022-05-30 | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option t… |
CVE-2022-0642 | Medium | 5.4 | 2022-05-30 | The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise so… |
CVE-2021-34360 | Medium | 5.3 | 2022-05-26 | A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote… |
CVE-2022-29002 | High | 8.8 | 2022-05-23 | A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add. |
CVE-2022-30014 | High | 8.8 | 2022-05-23 | Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account. |
CVE-2022-29431 | Medium | 5.4 | 2022-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. |
CVE-2022-29430 | Medium | 4.7 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_qual… |
CVE-2022-29427 | Medium | 4.3 | 2022-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. |
CVE-2022-28992 | High | 8.8 | 2022-05-20 | A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request. |
CVE-2022-28921 | Medium | 6.5 | 2022-05-18 | A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting… |
CVE-2022-22778 | High | 8.8 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows a… |
CVE-2022-27632 | High | 8.8 | 2022-05-18 | Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale]… |
CVE-2022-29436 | Medium | 4.7 | 2022-05-17 | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery… |
CVE-2022-29435 | Medium | 5.4 | 2022-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to… |
CVE-2022-29429 | High | 8.8 | 2022-05-17 | Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery. |
CVE-2022-30972 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e… |
CVE-2022-30969 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without s… |
CVE-2022-30958 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using… |
CVE-2022-30953 | Medium | 6.5 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP ser… |
CVE-2022-30946 | Medium | 4.3 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an… |
CVE-2022-1418 | Medium | 6.1 | 2022-05-16 | The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of th… |
CVE-2022-1407 | Medium | 6.5 | 2022-05-16 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape… |
CVE-2021-27759 | Low | 2.3 | 2022-05-06 | This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. A… |
CVE-2021-27758 | Medium | 4.3 | 2022-05-06 | There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system bloc… |
CVE-2022-1389 | Low | 3.1 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists… |
CVE-2022-25778 | Medium | 4.2 | 2022-05-04 | Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session. |
CVE-2022-0916 | High | 8.4 | 2022-05-03 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks duri… |
CVE-2022-0952 | High | 8.8 | 2022-05-02 | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure… |
CVE-2022-0191 | Medium | 6.5 | 2022-05-02 | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logge… |
CVE-2022-23904 | High | 8.0 | 2022-05-02 | Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and… |
CVE-2022-29451 | High | 8.8 | 2022-04-29 | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to… |
CVE-2022-29414 | Medium | 5.4 | 2022-04-29 | Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to c… |
CVE-2021-43937 | High | 7.6 | 2022-04-29 | Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally pro… |
CVE-2022-29905 | Medium | 4.3 | 2022-04-29 | The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF. |
CVE-2022-29903 | Medium | 4.3 | 2022-04-29 | The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the exten… |
CVE-2022-29555 | High | 8.8 | 2022-04-28 | The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking. |
CVE-2022-29413 | Medium | 4.7 | 2022-04-28 | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter. |
CVE-2022-29412 | Medium | 5.4 | 2022-04-28 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, creat… |
CVE-2022-28892 | High | 8.8 | 2022-04-28 | Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessa… |
CVE-2022-27860 | Medium | 6.1 | 2022-04-28 | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. |
CVE-2022-24879 | High | 7.5 | 2022-04-28 | Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token valid… |
CVE-2022-27375 | Medium | 6.5 | 2022-04-25 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at /goform/WifiExtraSet. |
CVE-2022-27374 | Medium | 6.5 | 2022-04-25 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at /goform/SysToolReboot. |