CWE-352 · Cross-Site Request Forgery (CSRF) (page 8)
Page 8 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25693 | High | 7.1 | 2026-04-12 | ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2026-6109 | Medium | 4.3 | 2026-04-12 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minec… |
CVE-2026-1924 | Medium | 4.3 | 2026-04-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing no… |
CVE-2026-39848 | Medium | 6.5 | 2026-04-09 | Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF prote… |
CVE-2025-70811 | Medium | 4.3 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management… |
CVE-2025-70810 | High | 8.8 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticatio… |
CVE-2026-5918 | Medium | 4.3 | 2026-04-08 | Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2026-34721 | Medium | 6.5 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook… |
CVE-2026-0811 | Medium | 5.4 | 2026-04-08 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to mis… |
CVE-2026-1673 | Medium | 4.3 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-1672 | Medium | 6.5 | 2026-04-08 | The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in al… |
CVE-2026-39710 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Them… |
CVE-2026-39671 | High | 7.1 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Reque… |
CVE-2026-39641 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a thro… |
CVE-2026-39640 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a throu… |
CVE-2026-39635 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine… |
CVE-2026-39634 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfol… |
CVE-2026-39633 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Re… |
CVE-2026-39632 | Medium | 6.5 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a th… |
CVE-2026-39621 | High | 8.8 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: f… |
CVE-2026-39620 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appoint… |
CVE-2026-39619 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: fro… |
CVE-2026-39618 | Medium | 4.3 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <=… |
CVE-2026-39617 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from… |
CVE-2026-39603 | Medium | 5.4 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Pho… |
CVE-2026-4141 | Medium | 4.3 | 2026-04-08 | The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce… |
CVE-2026-3499 | High | 8.8 | 2026-04-08 | The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1… |
CVE-2026-4401 | Medium | 5.4 | 2026-04-08 | The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class… |
CVE-2026-39371 | High | 8.1 | 2026-04-07 | RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests… |
CVE-2026-34904 | High | 7.5 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Soci… |
CVE-2026-34896 | High | 7.5 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue af… |
CVE-2026-35181 | Medium | 4.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not valida… |
CVE-2026-35180 | Medium | 4.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lac… |
CVE-2026-5624 | Medium | 4.3 | 2026-04-06 | A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in… |
CVE-2019-25682 | Medium | 4.3 | 2026-04-05 | CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML… |
CVE-2026-5572 | Medium | 4.3 | 2026-04-05 | A security flaw has been discovered in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This affects an unknown function. Performing a manipulation results in cro… |
CVE-2016-20054 | Medium | 4.3 | 2026-04-04 | Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. At… |
CVE-2016-20053 | Medium | 5.3 | 2026-04-04 | Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking aut… |
CVE-2016-20051 | Medium | 5.3 | 2026-04-04 | Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting… |
CVE-2026-34228 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The… |
CVE-2025-36375 | Medium | 6.5 | 2026-04-01 | IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 th… |
CVE-2026-34749 | Medium | 5.4 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the… |
CVE-2026-5283 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-34613 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or… |
CVE-2026-34611 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML… |
CVE-2026-34394 | High | 8.1 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF tok… |
CVE-2026-34384 | Medium | 4.5 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registratio… |
CVE-2026-34383 | Medium | 4.3 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST paramete… |
CVE-2026-34382 | Medium | 4.6 | 2026-03-31 | Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently dele… |
CVE-2026-3191 | Medium | 5.4 | 2026-03-31 | The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorr… |
CVE-2026-33373 | High | 8.8 | 2026-03-30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the i… |
CVE-2026-4315 | Medium | 6.5 | 2026-03-30 | A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condit… |
CVE-2026-4971 | Medium | 4.3 | 2026-03-27 | A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forge… |
CVE-2026-4968 | Medium | 4.3 | 2026-03-27 | A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can… |
CVE-2026-4984 | High | 8.2 | 2026-03-27 | The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches u… |
CVE-2026-4393 | Medium | 4.3 | 2026-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 be… |
CVE-2026-1032 | Medium | 4.3 | 2026-03-26 | The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonc… |
CVE-2025-36422 | Medium | 4.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request forgery which could allo… |
CVE-2026-3857 | High | 8.1 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have al… |
CVE-2026-27659 | Medium | 4.6 | 2026-03-25 | Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_contr… |
CVE-2026-3211 | Medium | 4.3 | 2026-03-25 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by… |
CVE-2025-40841 | Medium | 4.3 | 2026-03-25 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can lead to unauthorized… |
CVE-2026-29839 | High | 8.8 | 2026-03-24 | DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php. |
CVE-2026-33252 | High | 7.1 | 2026-03-24 | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` re… |
CVE-2026-33649 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parame… |
CVE-2026-33507 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload a… |
CVE-2026-4590 | Low | 3.1 | 2026-03-23 | A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/cont… |
CVE-2026-31849 | Medium | 6.5 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools an… |
CVE-2026-4143 | Medium | 4.3 | 2026-03-21 | The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to mi… |
CVE-2026-3332 | Medium | 4.3 | 2026-03-21 | The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to… |
CVE-2026-3331 | Medium | 4.3 | 2026-03-21 | The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing… |
CVE-2026-2723 | Medium | 6.1 | 2026-03-21 | The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce vali… |
CVE-2026-1503 | Medium | 4.3 | 2026-03-21 | The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0… |
CVE-2026-1393 | Medium | 4.3 | 2026-03-21 | The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2026-1392 | Medium | 4.3 | 2026-03-21 | The SR WP Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing nonce… |
CVE-2026-1390 | Medium | 4.3 | 2026-03-21 | The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce… |
CVE-2026-1378 | Medium | 4.3 | 2026-03-21 | The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce… |
CVE-2025-14037 | High | 8.1 | 2026-03-21 | The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This i… |
CVE-2026-32989 | High | 8.8 | 2026-03-20 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests… |
CVE-2026-33372 | Medium | 5.4 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper… |
CVE-2024-32537 | High | 7.1 | 2026-03-20 | Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from… |
CVE-2026-32816 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_… |
CVE-2026-32755 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.6 and below, the save_membership action in modules/profile/profile_function.php saves chang… |
CVE-2026-4068 | Medium | 4.3 | 2026-03-19 | The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to mis… |
CVE-2025-55046 | High | 8.1 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a sim… |
CVE-2025-55045 | High | 7.1 | 2026-03-18 | The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.up… |
CVE-2025-55044 | High | 8.8 | 2026-03-18 | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CS… |
CVE-2025-55043 | Medium | 6.5 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated atta… |
CVE-2025-55041 | High | 8.0 | 2026-03-18 | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attacker… |
CVE-2025-55040 | High | 8.8 | 2026-03-18 | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vuln… |
CVE-2026-22323 | High | 7.1 | 2026-03-18 | A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauth… |
CVE-2026-27978 | Medium | 4.3 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a… |
CVE-2026-32839 | Medium | 4.3 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized adm… |
CVE-2026-29521 | Medium | 4.3 | 2026-03-16 | Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by… |
CVE-2025-69238 | Medium | 4.3 | 2026-03-16 | Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated v… |
CVE-2017-20221 | Medium | 4.3 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary… |
CVE-2016-20035 | Medium | 5.3 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious… |
CVE-2016-20034 | High | 8.8 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by… |
CVE-2016-20028 | Medium | 4.3 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in user… |
CVE-2015-20117 | Medium | 5.3 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user ac… |