CWE-352 · Cross-Site Request Forgery (CSRF) (page 63)
Page 63 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4162 | Medium | 4.3 | 2021-12-25 | archivy is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2020-20595 | Medium | 6.5 | 2021-12-22 | A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add. |
CVE-2020-20593 | High | 8.0 | 2021-12-22 | A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. |
CVE-2021-36886 | Medium | 6.5 | 2021-12-22 | Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). |
CVE-2021-43158 | Medium | 4.3 | 2021-12-22 | In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart. |
CVE-2021-43156 | Medium | 6.5 | 2021-12-22 | In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book. |
CVE-2021-24981 | High | 7.5 | 2021-12-21 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in th… |
CVE-2021-43846 | Medium | 5.3 | 2021-12-20 | `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a c… |
CVE-2021-36887 | Medium | 6.1 | 2021-12-20 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plu… |
CVE-2021-4131 | High | 8.8 | 2021-12-18 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4130 | High | 8.8 | 2021-12-18 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-26800 | Medium | 6.5 | 2021-12-16 | Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attacker… |
CVE-2021-41260 | High | 8.2 | 2021-12-16 | Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross… |
CVE-2021-4123 | Medium | 6.5 | 2021-12-16 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-45017 | High | 8.8 | 2021-12-15 | Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor… |
CVE-2021-44942 | Medium | 4.3 | 2021-12-14 | glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF v… |
CVE-2021-24945 | High | 8.0 | 2021-12-13 | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which… |
CVE-2021-24922 | Critical | 9.0 | 2021-12-13 | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could… |
CVE-2021-24836 | Medium | 4.3 | 2021-12-13 | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows a… |
CVE-2021-24818 | Medium | 4.3 | 2021-12-13 | The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which co… |
CVE-2021-24795 | Medium | 6.5 | 2021-12-13 | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attacke… |
CVE-2021-24790 | Medium | 4.3 | 2021-12-13 | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_… |
CVE-2021-24784 | Medium | 6.5 | 2021-12-13 | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin… |
CVE-2021-24780 | Medium | 4.3 | 2021-12-13 | The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-4092 | Medium | 4.3 | 2021-12-11 | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4082 | Medium | 4.3 | 2021-12-10 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4033 | Medium | 6.5 | 2021-12-09 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2020-19682 | High | 8.8 | 2021-12-09 | A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php. |
CVE-2021-4049 | Medium | 6.5 | 2021-12-07 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-31631 | High | 8.8 | 2021-12-06 | b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate p… |
CVE-2021-35242 | High | 8.3 | 2021-12-06 | Serv-U server responds with valid CSRFToken when the request contains only Session. |
CVE-2021-24914 | High | 8.0 | 2021-12-06 | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, avai… |
CVE-2021-4005 | Medium | 4.3 | 2021-12-04 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-29756 | High | 8.8 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicio… |
CVE-2015-20105 | Critical | 9.6 | 2021-12-02 | The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change t… |
CVE-2021-3944 | Medium | 6.8 | 2021-12-02 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-44227 | High | 8.8 | 2021-12-02 | In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make… |
CVE-2021-43137 | High | 8.8 | 2021-12-01 | Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chai… |
CVE-2021-4017 | High | 8.8 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4015 | Medium | 4.3 | 2021-12-01 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3993 | Medium | 6.5 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-20860 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167G… |
CVE-2021-20851 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack… |
CVE-2021-42364 | High | 8.8 | 2021-11-29 | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php f… |
CVE-2021-42358 | High | 8.8 | 2021-11-29 | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during c… |
CVE-2021-24822 | Medium | 5.4 | 2021-11-29 | The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticat… |
CVE-2021-24749 | Medium | 4.3 | 2021-11-29 | The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logg… |
CVE-2021-43777 | Medium | 6.8 | 2021-11-24 | Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `… |
CVE-2021-20846 | High | 8.8 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authe… |
CVE-2021-20845 | High | 8.8 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of… |
CVE-2021-20842 | Medium | 6.5 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2021-24668 | Medium | 4.3 | 2021-11-23 | The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF a… |
CVE-2021-24641 | High | 8.1 | 2021-11-23 | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modificati… |
CVE-2021-43559 | High | 8.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality… |
CVE-2021-34358 | Medium | 6.8 | 2021-11-20 | We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later |
CVE-2021-39198 | Medium | 4.2 | 2021-11-19 | OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is… |
CVE-2021-44036 | High | 8.8 | 2021-11-19 | Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import. |
CVE-2021-39353 | High | 8.8 | 2021-11-19 | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found i… |
CVE-2021-3963 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3957 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3976 | Medium | 6.5 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-36908 | High | 8.8 | 2021-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions. |
CVE-2021-41275 | Critical | 9.3 | 2021-11-17 | spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an un… |
CVE-2021-41274 | Critical | 9.3 | 2021-11-17 | solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subj… |
CVE-2021-41273 | Medium | 4.3 | 2021-11-17 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a mali… |
CVE-2021-24853 | Medium | 4.3 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action… |
CVE-2021-24852 | Medium | 6.5 | 2021-11-17 | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged i… |
CVE-2021-24804 | High | 8.8 | 2021-11-17 | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed th… |
CVE-2021-24802 | Medium | 6.5 | 2021-11-17 | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change tax… |
CVE-2021-24776 | Medium | 4.3 | 2021-11-17 | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in… |
CVE-2021-25965 | High | 8.8 | 2021-11-16 | In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker c… |
CVE-2021-25976 | High | 8.1 | 2021-11-16 | In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management s… |
CVE-2021-3776 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3775 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3683 | Medium | 6.5 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3932 | Medium | 4.3 | 2021-11-13 | twill is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3931 | Medium | 4.3 | 2021-11-13 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3921 | Medium | 4.3 | 2021-11-13 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2020-21141 | High | 8.8 | 2021-11-12 | iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. |
CVE-2020-28137 | Medium | 6.5 | 2021-11-10 | Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting the router. |
CVE-2021-41426 | High | 8.8 | 2021-11-10 | Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm. |
CVE-2021-40518 | Medium | 6.5 | 2021-11-10 | Airangel HSMX Gateway devices through 5.2.04 allow CSRF. |
CVE-2021-41372 | High | 7.6 | 2021-11-10 | A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files… |
CVE-2021-24832 | Medium | 4.3 | 2021-11-08 | The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admi… |
CVE-2021-24806 | Medium | 4.3 | 2021-11-08 | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users s… |
CVE-2021-24801 | Medium | 4.3 | 2021-11-08 | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them an… |
CVE-2021-24767 | Medium | 6.5 | 2021-11-08 | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow at… |
CVE-2021-24766 | Medium | 6.5 | 2021-11-08 | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow… |
CVE-2021-24674 | Medium | 6.5 | 2021-11-08 | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admi… |
CVE-2021-24626 | High | 8.8 | 2021-11-08 | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as sub… |
CVE-2020-21139 | Medium | 6.5 | 2021-11-04 | EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /adm… |
CVE-2021-34773 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2020-23686 | High | 8.8 | 2021-11-02 | Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts. |
CVE-2021-29888 | High | 8.8 | 2021-11-02 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-24809 | High | 8.8 | 2021-11-01 | The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messa… |
CVE-2021-24799 | Medium | 4.3 | 2021-11-01 | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-24685 | Medium | 5.4 | 2021-11-01 | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which co… |
CVE-2021-24572 | Medium | 4.3 | 2021-11-01 | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletio… |
CVE-2021-24570 | Medium | 4.3 | 2021-11-01 | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create… |