CWE-352 · Cross-Site Request Forgery (CSRF) (page 67)
Page 67 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-20642 | High | 8.8 | 2021-08-19 | Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=n… |
CVE-2021-34645 | High | 8.8 | 2021-08-19 | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/i… |
CVE-2020-19669 | High | 8.8 | 2021-08-18 | Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn. |
CVE-2021-20758 | High | 8.0 | 2021-08-18 | Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication… |
CVE-2020-28846 | Medium | 6.5 | 2021-08-17 | Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. |
CVE-2020-4992 | Medium | 6.5 | 2021-08-17 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho… |
CVE-2021-24536 | Medium | 6.1 | 2021-08-16 | The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input b… |
CVE-2021-24535 | Medium | 6.1 | 2021-08-16 | The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with… |
CVE-2021-24466 | Medium | 6.1 | 2021-08-16 | The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted action… |
CVE-2021-24411 | Medium | 6.1 | 2021-08-16 | The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting… |
CVE-2021-24410 | Medium | 6.1 | 2021-08-16 | The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when o… |
CVE-2021-24380 | Medium | 4.3 | 2021-08-16 | The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrat… |
CVE-2020-22403 | High | 8.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecifie… |
CVE-2020-20989 | Medium | 4.3 | 2021-08-12 | A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs. |
CVE-2020-18464 | Low | 3.5 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in AikCms 2.0.0 in video_list.php, which can let a malicious user delete movie information. |
CVE-2020-18463 | Low | 2.4 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in v2.0.0 in video_list.php, which can let a malicious user delete a video message. |
CVE-2020-18460 | High | 8.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content. |
CVE-2020-18458 | High | 8.0 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd. |
CVE-2020-18457 | Medium | 6.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html. |
CVE-2020-18454 | Medium | 6.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_id/1.html. |
CVE-2020-25562 | Medium | 6.5 | 2021-08-11 | In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account… |
CVE-2021-32122 | Critical | 9.8 | 2021-08-11 | Certain NETGEAR devices are affected by CSRF. This affects EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, and EX6130 before 1.0.0.44. |
CVE-2021-29400 | Medium | 6.5 | 2021-08-10 | A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of… |
CVE-2021-37366 | High | 8.8 | 2021-08-10 | CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick t… |
CVE-2021-34661 | Medium | 6.1 | 2021-08-09 | The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/clas… |
CVE-2021-24500 | High | 8.1 | 2021-08-09 | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that… |
CVE-2021-24467 | Medium | 6.5 | 2021-08-09 | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update… |
CVE-2020-21358 | Medium | 6.5 | 2021-08-06 | A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users. |
CVE-2020-18694 | High | 8.8 | 2021-08-06 | Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profi… |
CVE-2021-37381 | High | 8.8 | 2021-08-06 | Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's… |
CVE-2021-34634 | High | 8.8 | 2021-08-05 | The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file wh… |
CVE-2021-34633 | High | 8.8 | 2021-08-05 | The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which al… |
CVE-2021-34631 | High | 8.8 | 2021-08-05 | The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows… |
CVE-2021-23849 | High | 7.5 | 2021-08-05 | A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF -… |
CVE-2021-33338 | High | 7.5 | 2021-08-04 | The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, whi… |
CVE-2021-36543 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unloc… |
CVE-2021-36542 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any… |
CVE-2021-35343 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document nam… |
CVE-2021-34637 | High | 8.8 | 2021-08-02 | The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows atta… |
CVE-2021-34632 | High | 8.8 | 2021-08-02 | The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows a… |
CVE-2021-34628 | High | 8.8 | 2021-08-02 | The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Lo… |
CVE-2021-29757 | High | 8.8 | 2021-08-02 | IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized action… |
CVE-2021-24504 | Medium | 6.1 | 2021-08-02 | The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be… |
CVE-2021-24477 | Medium | 6.1 | 2021-08-02 | The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site S… |
CVE-2021-20786 | Medium | 4.3 | 2021-07-30 | Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud… |
CVE-2021-20783 | High | 8.8 | 2021-07-30 | Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a spec… |
CVE-2020-22761 | High | 8.8 | 2021-07-30 | Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php. |
CVE-2020-18157 | High | 8.8 | 2021-07-30 | Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php. |
CVE-2021-32776 | Medium | 6.8 | 2021-07-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cle… |
CVE-2021-21407 | High | 8.0 | 2021-07-21 | Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via… |
CVE-2021-34619 | High | 8.8 | 2021-07-21 | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2… |
CVE-2020-15660 | High | 8.8 | 2021-07-20 | Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared re… |
CVE-2021-32774 | Medium | 6.1 | 2021-07-20 | DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CS… |
CVE-2020-4675 | Medium | 6.5 | 2021-07-16 | IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2020-18151 | Medium | 6.5 | 2021-07-14 | Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. |
CVE-2020-27379 | Medium | 6.5 | 2021-07-14 | Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the r… |
CVE-2021-20782 | High | 8.8 | 2021-07-14 | Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of adm… |
CVE-2021-20781 | High | 8.8 | 2021-07-14 | Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allow… |
CVE-2021-24434 | Medium | 6.1 | 2021-07-12 | The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scri… |
CVE-2020-4938 | High | 8.8 | 2021-07-12 | IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitte… |
CVE-2020-20586 | Medium | 4.5 | 2021-07-08 | A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the adminis… |
CVE-2021-34620 | High | 8.8 | 2021-07-07 | The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Esca… |
CVE-2021-22224 | High | 7.1 | 2021-07-07 | A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call… |
CVE-2021-20780 | High | 8.8 | 2021-07-07 | Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of… |
CVE-2021-20779 | High | 8.8 | 2021-07-07 | Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack t… |
CVE-2021-24388 | Medium | 5.4 | 2021-07-06 | In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the use… |
CVE-2021-32730 | Medium | 5.7 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in v… |
CVE-2021-21675 | Medium | 6.5 | 2021-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administ… |
CVE-2021-20580 | Medium | 4.3 | 2021-06-29 | IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-20102 | High | 8.8 | 2021-06-29 | Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place. |
CVE-2020-18648 | High | 8.8 | 2021-06-22 | Cross Site Request Forgery (CSRF) in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMS_v1.0/admin/index.php?c=admini… |
CVE-2021-34244 | High | 8.8 | 2021-06-22 | A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' pass… |
CVE-2020-20468 | Medium | 6.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password. |
CVE-2021-32424 | High | 8.8 | 2021-06-17 | In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially… |
CVE-2020-36389 | Medium | 4.3 | 2021-06-17 | In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. |
CVE-2020-35759 | Medium | 6.5 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely). |
CVE-2021-24349 | Medium | 6.1 | 2021-06-14 | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized befo… |
CVE-2020-13663 | High | 8.8 | 2021-06-11 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other… |
CVE-2021-34547 | Medium | 4.3 | 2021-06-10 | PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation. |
CVE-2021-31659 | High | 8.8 | 2021-06-10 | TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed i… |
CVE-2021-21665 | High | 8.8 | 2021-06-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2021-32677 | High | 8.2 | 2021-06-09 | FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for aut… |
CVE-2021-29995 | High | 8.8 | 2021-06-09 | A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (incl… |
CVE-2021-26474 | High | 8.6 | 2021-06-08 | Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family m… |
CVE-2020-26516 | High | 8.8 | 2021-06-08 | A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and c… |
CVE-2020-18265 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-18264 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-36140 | Medium | 6.5 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change an… |
CVE-2020-35972 | Medium | 4.3 | 2021-06-03 | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
CVE-2020-10771 | High | 7.1 | 2021-06-02 | A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an… |
CVE-2021-24333 | Medium | 6.5 | 2021-06-01 | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and… |
CVE-2021-24328 | Medium | 6.2 | 2021-06-01 | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. Th… |
CVE-2020-26641 | High | 8.8 | 2021-05-28 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts. |
CVE-2019-14836 | High | 8.8 | 2021-05-26 | A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access un… |
CVE-2021-26034 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sy… |
CVE-2021-26033 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint. |
CVE-2021-20096 | High | 8.1 | 2021-05-25 | Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking… |
CVE-2020-25411 | Medium | 6.5 | 2021-05-24 | Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user. |
CVE-2020-25408 | Medium | 6.5 | 2021-05-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or… |
CVE-2021-21549 | High | 8.8 | 2021-05-21 | Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this… |