CWE-352 · Cross-Site Request Forgery (CSRF) (page 7)
Page 7 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55044 | High | 8.8 | 2026-03-18 | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CS… |
CVE-2025-55043 | Medium | 6.5 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated atta… |
CVE-2025-55041 | High | 8.0 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attacker… |
CVE-2025-55040 | High | 8.8 | 2026-03-18 | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vuln… |
CVE-2026-22323 | High | 7.1 | 2026-03-18 | A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauth… |
CVE-2026-27978 | Medium | 4.3 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a… |
CVE-2026-32839 | Medium | 4.3 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized adm… |
CVE-2026-29521 | Medium | 4.3 | 2026-03-16 | Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by… |
CVE-2025-69238 | Medium | 4.3 | 2026-03-16 | Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated v… |
CVE-2017-20221 | Medium | 4.3 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary… |
CVE-2016-20035 | Medium | 5.3 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious… |
CVE-2016-20034 | High | 8.8 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by… |
CVE-2016-20028 | Medium | 4.3 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in user… |
CVE-2015-20117 | Medium | 5.3 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user ac… |
CVE-2015-20113 | Medium | 5.3 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent cross-site scripting vulnerabilities that allow attackers to perform… |
CVE-2026-32456 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin M… |
CVE-2026-32443 | Medium | 6.5 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This i… |
CVE-2026-32420 | Medium | 5.4 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a th… |
CVE-2026-32344 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in desertthemes Corpiva corpiva allows Cross Site Request Forgery.This issue affects Corpiva: from n/a through… |
CVE-2026-32343 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Easy Table of Contents easy-table-of-contents allows Cross Site Request Forgery.This issue affects… |
CVE-2026-32342 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a thro… |
CVE-2026-32330 | Medium | 4.3 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Galler… |
CVE-2026-32328 | Medium | 5.4 | 2026-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in shufflehound Lemmony lemmony allows Cross Site Request Forgery.This issue affects Lemmony: from n/a through… |
CVE-2026-22215 | Medium | 4.3 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actio… |
CVE-2026-22202 | High | 8.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by cra… |
CVE-2026-31954 | Unrated | | 2026-03-11 | Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), e… |
CVE-2026-30868 | Medium | 6.3 | 2026-03-11 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are acces… |
CVE-2026-3903 | Medium | 4.3 | 2026-03-11 | The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-2626 | High | 8.1 | 2026-03-11 | The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to mod… |
CVE-2026-2324 | Medium | 6.1 | 2026-03-11 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2026-29113 | Medium | 4.3 | 2026-03-10 | Craft is a content management system (CMS). Prior to 4.17.4 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-toke… |
CVE-2026-28495 | Critical | 9.6 | 2026-03-10 | GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to ov… |
CVE-2026-28281 | High | 7.1 | 2026-03-10 | InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderat… |
CVE-2026-1508 | Medium | 4.3 | 2026-03-10 | The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in a… |
CVE-2025-70031 | High | 8.8 | 2026-03-09 | An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. |
CVE-2026-3770 | Medium | 4.3 | 2026-03-08 | A flaw has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part. This manipulation causes cross-site request fo… |
CVE-2026-29784 | High | 7.5 | 2026-03-07 | Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs i… |
CVE-2026-1087 | Medium | 4.3 | 2026-03-07 | The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce… |
CVE-2026-1086 | Medium | 4.3 | 2026-03-07 | The Font Pairing Preview For Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is… |
CVE-2026-1085 | Medium | 4.3 | 2026-03-07 | The True Ranker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.9. This is due to missing nonce vali… |
CVE-2026-1073 | Medium | 4.3 | 2026-03-07 | The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is du… |
CVE-2026-2494 | Medium | 4.3 | 2026-03-07 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-1644 | Medium | 4.3 | 2026-03-07 | The WP Frontend Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing no… |
CVE-2018-25200 | Medium | 5.3 | 2026-03-06 | OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting m… |
CVE-2018-25190 | Medium | 5.3 | 2026-03-06 | Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged… |
CVE-2018-25186 | Medium | 5.3 | 2026-03-06 | Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests… |
CVE-2018-25177 | Medium | 5.3 | 2026-03-06 | Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by su… |
CVE-2018-25176 | High | 8.2 | 2026-03-06 | Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t… |
CVE-2018-25174 | Medium | 5.3 | 2026-03-06 | ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credentials by submitting forged requests to _c… |
CVE-2018-25170 | High | 8.2 | 2026-03-06 | DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id… |
CVE-2026-1468 | | 2026-03-06 | QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will a… | |
CVE-2026-3589 | High | 7.5 | 2026-03-06 | The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logge… |
CVE-2026-1128 | Medium | 4.3 | 2026-03-06 | The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin… |
CVE-2026-29084 | Medium | 4.6 | 2026-03-06 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing… |
CVE-2025-59541 | High | 8.1 | 2026-03-06 | Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects insi… |
CVE-2026-28477 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSR… |
CVE-2026-30793 | Critical | 9.8 | 2026-03-05 | Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme h… |
CVE-2025-64166 | Medium | 5.4 | 2026-03-05 | Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from in… |
CVE-2026-2994 | Medium | 6.8 | 2026-03-04 | Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can… |
CVE-2021-35486 | High | 8.1 | 2026-03-03 | A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the ent… |
CVE-2026-27758 | Medium | 4.3 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a cross-site request forgery vulnerability in its management interface that allows attackers… |
CVE-2026-3193 | Low | 3.1 | 2026-02-25 | A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site re… |
CVE-2026-2410 | Medium | 4.3 | 2026-02-25 | The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-27632 | Low | 2.6 | 2026-02-25 | Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request For… |
CVE-2026-27609 | Medium | 6.5 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /a… |
CVE-2026-27589 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a… |
CVE-2026-27518 | Medium | 4.3 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing actions in the administrative interfac… |
CVE-2026-27741 | Medium | 4.3 | 2026-02-23 | Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The appli… |
CVE-2026-25649 | High | 7.3 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorizat… |
CVE-2026-23694 | | 2026-02-23 | Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple… | |
CVE-2026-27513 | Medium | 4.3 | 2026-02-23 | Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interf… |
CVE-2026-27146 | Medium | 4.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a r… |
CVE-2019-25447 | Medium | 4.3 | 2026-02-20 | OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malic… |
CVE-2025-13671 | Medium | 6.5 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user… |
CVE-2026-26317 | High | 7.1 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origi… |
CVE-2026-27090 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companio… |
CVE-2026-27050 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a throu… |
CVE-2026-25422 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Ext… |
CVE-2026-25411 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects… |
CVE-2026-25337 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through… |
CVE-2026-25322 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects Publish… |
CVE-2026-25319 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpzita Zita Elementor Site Library zita-site-library allows Cross Site Request Forgery.This issue affects Zi… |
CVE-2026-1455 | Medium | 4.3 | 2026-02-19 | The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2025-14167 | Medium | 4.3 | 2026-02-19 | The Remove Post Type Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to incorrec… |
CVE-2025-13438 | Medium | 4.3 | 2026-02-19 | The Page Title, Description & Open Graph Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.02. T… |
CVE-2025-13413 | Medium | 4.3 | 2026-02-19 | The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to miss… |
CVE-2025-12821 | High | 8.8 | 2026-02-19 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce vali… |
CVE-2025-12172 | Medium | 4.3 | 2026-02-19 | The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to… |
CVE-2019-25359 | High | 8.2 | 2026-02-18 | SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL statements through POST parameters 'idtyp… |
CVE-2025-70062 | Medium | 6.5 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enfo… |
CVE-2026-2658 | Medium | 4.3 | 2026-02-18 | A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple E… |
CVE-2026-2112 | Medium | 4.3 | 2026-02-18 | The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verific… |
CVE-2026-2023 | Medium | 4.3 | 2026-02-18 | The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing no… |
CVE-2026-1072 | Medium | 4.3 | 2026-02-18 | The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missin… |
CVE-2025-27904 | Medium | 6.5 | 2026-02-17 | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to cross-site request forgery which could… |
CVE-2025-36018 | Medium | 6.5 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor… |
CVE-2024-55271 | Low | 3.5 | 2026-02-17 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This issue is present in the profile update func… |
CVE-2026-1394 | Medium | 4.3 | 2026-02-14 | The WP Quick Contact Us plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonc… |
CVE-2025-14873 | Medium | 4.3 | 2026-02-14 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2025-14852 | Medium | 4.3 | 2026-02-14 | The MDirector Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.8. This is due to missing n… |