CWE-352 · Cross-Site Request Forgery (CSRF) (page 65)
Page 65 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45017 | High | 8.8 | 2021-12-15 | Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor… |
CVE-2021-44942 | Medium | 4.3 | 2021-12-14 | glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF v… |
CVE-2021-24945 | High | 8.0 | 2021-12-13 | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which… |
CVE-2021-24922 | Critical | 9.0 | 2021-12-13 | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could… |
CVE-2021-24836 | Medium | 4.3 | 2021-12-13 | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows a… |
CVE-2021-24818 | Medium | 4.3 | 2021-12-13 | The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which co… |
CVE-2021-24795 | Medium | 6.5 | 2021-12-13 | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attacke… |
CVE-2021-24790 | Medium | 4.3 | 2021-12-13 | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_… |
CVE-2021-24784 | Medium | 6.5 | 2021-12-13 | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin… |
CVE-2021-24780 | Medium | 4.3 | 2021-12-13 | The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-4092 | Medium | 4.3 | 2021-12-11 | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4082 | Medium | 4.3 | 2021-12-10 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4033 | Medium | 6.5 | 2021-12-09 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2020-19682 | High | 8.8 | 2021-12-09 | A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php. |
CVE-2021-4049 | Medium | 6.5 | 2021-12-07 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-31631 | High | 8.8 | 2021-12-06 | b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate p… |
CVE-2021-35242 | High | 8.3 | 2021-12-06 | Serv-U server responds with valid CSRFToken when the request contains only Session. |
CVE-2021-24914 | High | 8.0 | 2021-12-06 | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, avai… |
CVE-2021-4005 | Medium | 4.3 | 2021-12-04 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-29756 | High | 8.8 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicio… |
CVE-2015-20105 | Critical | 9.6 | 2021-12-02 | The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change t… |
CVE-2021-3944 | Medium | 6.8 | 2021-12-02 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-44227 | High | 8.8 | 2021-12-02 | In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make… |
CVE-2021-43137 | High | 8.8 | 2021-12-01 | Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chai… |
CVE-2021-4017 | High | 8.8 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4015 | Medium | 4.3 | 2021-12-01 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3993 | Medium | 6.5 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-20860 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167G… |
CVE-2021-20851 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack… |
CVE-2021-42364 | High | 8.8 | 2021-11-29 | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php f… |
CVE-2021-42358 | High | 8.8 | 2021-11-29 | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during c… |
CVE-2021-24822 | Medium | 5.4 | 2021-11-29 | The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticat… |
CVE-2021-24749 | Medium | 4.3 | 2021-11-29 | The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logg… |
CVE-2021-43777 | Medium | 6.8 | 2021-11-24 | Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `… |
CVE-2021-20846 | High | 8.8 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authe… |
CVE-2021-20845 | High | 8.8 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of… |
CVE-2021-20842 | Medium | 6.5 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2021-24668 | Medium | 4.3 | 2021-11-23 | The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF a… |
CVE-2021-24641 | High | 8.1 | 2021-11-23 | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modificati… |
CVE-2021-43559 | High | 8.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality… |
CVE-2021-34358 | Medium | 6.8 | 2021-11-20 | We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later |
CVE-2021-39198 | Medium | 4.2 | 2021-11-19 | OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is… |
CVE-2021-44036 | High | 8.8 | 2021-11-19 | Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import. |
CVE-2021-39353 | High | 8.8 | 2021-11-19 | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found i… |
CVE-2021-3963 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3957 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3976 | Medium | 6.5 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-36908 | High | 8.8 | 2021-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions. |
CVE-2021-41275 | Critical | 9.3 | 2021-11-17 | spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an un… |
CVE-2021-41274 | Critical | 9.3 | 2021-11-17 | solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subj… |
CVE-2021-41273 | Medium | 4.3 | 2021-11-17 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a mali… |
CVE-2021-24853 | Medium | 4.3 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action… |
CVE-2021-24852 | Medium | 6.5 | 2021-11-17 | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged i… |
CVE-2021-24804 | High | 8.8 | 2021-11-17 | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed th… |
CVE-2021-24802 | Medium | 6.5 | 2021-11-17 | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change tax… |
CVE-2021-24776 | Medium | 4.3 | 2021-11-17 | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in… |
CVE-2021-25965 | High | 8.8 | 2021-11-16 | In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker c… |
CVE-2021-25976 | High | 8.1 | 2021-11-16 | In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management s… |
CVE-2021-3776 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3775 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3683 | Medium | 6.5 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3932 | Medium | 4.3 | 2021-11-13 | twill is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3931 | Medium | 4.3 | 2021-11-13 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3921 | Medium | 4.3 | 2021-11-13 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2020-21141 | High | 8.8 | 2021-11-12 | iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. |
CVE-2020-28137 | Medium | 6.5 | 2021-11-10 | Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting the router. |
CVE-2021-41426 | High | 8.8 | 2021-11-10 | Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm. |
CVE-2021-40518 | Medium | 6.5 | 2021-11-10 | Airangel HSMX Gateway devices through 5.2.04 allow CSRF. |
CVE-2021-41372 | High | 7.6 | 2021-11-10 | A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files… |
CVE-2021-24832 | Medium | 4.3 | 2021-11-08 | The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admi… |
CVE-2021-24806 | Medium | 4.3 | 2021-11-08 | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users s… |
CVE-2021-24801 | Medium | 4.3 | 2021-11-08 | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them an… |
CVE-2021-24767 | Medium | 6.5 | 2021-11-08 | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow at… |
CVE-2021-24766 | Medium | 6.5 | 2021-11-08 | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow… |
CVE-2021-24674 | Medium | 6.5 | 2021-11-08 | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admi… |
CVE-2021-24626 | High | 8.8 | 2021-11-08 | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as sub… |
CVE-2020-21139 | Medium | 6.5 | 2021-11-04 | EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /adm… |
CVE-2021-34773 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2020-23686 | High | 8.8 | 2021-11-02 | Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts. |
CVE-2021-29888 | High | 8.8 | 2021-11-02 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-24809 | High | 8.8 | 2021-11-01 | The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messa… |
CVE-2021-24799 | Medium | 4.3 | 2021-11-01 | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-24685 | Medium | 5.4 | 2021-11-01 | The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which co… |
CVE-2021-24572 | Medium | 4.3 | 2021-11-01 | The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletio… |
CVE-2021-24570 | Medium | 4.3 | 2021-11-01 | The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create… |
CVE-2020-36505 | Medium | 6.5 | 2021-11-01 | The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attac… |
CVE-2020-36504 | Medium | 6.5 | 2021-11-01 | The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin d… |
CVE-2015-10001 | Medium | 4.3 | 2021-11-01 | The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing att… |
CVE-2021-3901 | High | 8.8 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3900 | Medium | 6.5 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-41176 | Medium | 4.3 | 2021-10-25 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a… |
CVE-2021-24884 | Critical | 9.6 | 2021-10-25 | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an u… |
CVE-2021-24779 | Medium | 6.5 | 2021-10-25 | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a… |
CVE-2021-24543 | Medium | 6.1 | 2021-10-25 | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and… |
CVE-2021-24487 | High | 8.8 | 2021-10-25 | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also… |
CVE-2021-20120 | High | 8.8 | 2021-10-21 | The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker c… |
CVE-2021-39126 | Medium | 6.5 | 2021-10-21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerabi… |
CVE-2021-34743 | Medium | 4.3 | 2021-10-21 | A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external applica… |
CVE-2021-42097 | High | 8.0 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value wi… |