Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,939)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-18409 1Catfishcms Project 1Catfishcms Jun 17, 2026 Jun 27, 2023 N/A· v4 6.8 MEDIUM· v3 N/A· v2 Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
CVE-2020-18416 1Jyuu 1Jymusic Jun 17, 2026 Jun 27, 2023 N/A· v4 6.8 MEDIUM· v3 N/A· v2 An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to modify payment information.
CVE-2020-18418 1Feifeicms 1Feifeicms Jun 17, 2026 Jun 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert.
CVE-2023-34839 1Issabel 1Pbx Jun 17, 2026 Jun 27, 2023 N/A· v4 6.8 MEDIUM· v3 N/A· v2 A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
CVE-2023-3411 1Webcraftplugins 1Image Map Pro Jun 17, 2026 Jun 27, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on...Show more The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.Show less
CVE-2023-1722 1Yoga Class Registration System Project 1Yoga Class Registration System Jun 17, 2026 Jun 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the adm...Show more Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators. Show less
CVE-2023-34028 1Pluginus 1Wolf Wordpress Posts Bulk Editor And Manager Professional Jun 17, 2026 Jun 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.
CVE-2023-34927 1Casbin 1Casdoor Jun 17, 2026 Jun 22, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplyi...Show more Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.Show less
CVE-2023-32960 1Updraftplus 1Updraftplus Jun 17, 2026 Jun 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
CVE-2023-35917 1Woocommerce 1Paypal Payments Jun 17, 2026 Jun 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
CVE-2023-23795 1Web Settler 1Form Builder Jun 17, 2026 Jun 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.
CVE-2022-3372 1Riello Ups 1Netman 204 Firmware Jun 17, 2026 Jun 21, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vuln...Show more There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.Show less
CVE-2023-2533 1Papercut 2Papercut Mf Papercut Ng Jun 17, 2026 Jun 20, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This c...Show more A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.Show less
CVE-2020-21366 1Njtech 1Greencms Jun 17, 2026 Jun 20, 2023 N/A· v4 8.0 HIGH· v3 N/A· v2 Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.
CVE-2020-21252 1Hongcms Project 1Hongcms Jun 17, 2026 Jun 20, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
CVE-2020-20726 1Gilacms 1Gila Cms Jun 17, 2026 Jun 20, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.
CVE-2020-20502 1Yzmcms 1Yzmcms Jun 17, 2026 Jun 20, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
CVE-2023-34373 1Zephyr Project Manager Project 1Zephyr Project Manager Jun 17, 2026 Jun 19, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.
CVE-2023-30759 1Ricoh 1Printer Driver Packager Nx Jun 17, 2026 Jun 19, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative use...Show more The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative user modifies the driver installation package and runs it on the target PC, an arbitrary program may be executed with the administrative privilege.Show less
CVE-2023-27634 1Intrepidity Project 1Intrepidity Jun 17, 2026 Jun 15, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions.

Previous 1...269270271...497 Next