Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,678)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-24415 1Quantumcloud 1Chatbot Jun 17, 2026 Feb 23, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.
CVE-2023-0988 1Online Pizza Ordering System Project 1Online Pizza Ordering System Jun 17, 2026 Feb 23, 2023 N/A· v4 8.8 HIGH· v3 5.0 MEDIUM· v2 A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipul...Show more A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221681 was assigned to this vulnerability.Show less
CVE-2023-24384 1Wpdevart 1Organization Chart Jun 17, 2026 Feb 23, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions.
CVE-2023-23659 1Mainwp 1Motomo Jun 17, 2026 Feb 23, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.
CVE-2022-4386 1Intuitive Custom Post Order Project 1Intuitive Custom Post Order Jun 17, 2026 Feb 21, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack
CVE-2022-48320 1Checkmk 1Checkmk Jun 17, 2026 Feb 20, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.
CVE-2015-10081 1Submitbymailplugin Project 1Submitbymailplugin Nov 21, 2024 Feb 20, 2023 N/A· v4 8.8 HIGH· v3 5.0 MEDIUM· v2 A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery....Show more A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.Show less
CVE-2023-25569 1Apolloconfig 1Apollo Jun 17, 2026 Feb 20, 2023 N/A· v4 5.7 MEDIUM· v3 N/A· v2 Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign...Show more Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages. Show less
CVE-2023-24388 1Wpdevart 1Booking Calendar Jun 17, 2026 Feb 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
CVE-2023-23899 1Hasthemes 1Extensions For Cf7 Jun 17, 2026 Feb 17, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.
CVE-2021-33396 1Baijiacms Project 1Baijiacms Jun 17, 2026 Feb 15, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
CVE-2023-23847 1Jenkins 1Synopsys Coverity Jun 17, 2026 Feb 15, 2023 N/A· v4 3.5 LOW· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained t...Show more A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-23465 1Mediacp 1Media Control Panel Jun 17, 2026 Feb 15, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.
CVE-2023-25767 1Jenkins 1Azure Credentials Jun 17, 2026 Feb 15, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
CVE-2022-47373 1Pandorafms 1Pandora Fms Jun 17, 2026 Feb 15, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper i...Show more Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.Show less
CVE-2022-47372 1Pandorafms 1Pandora Fms Jun 17, 2026 Feb 15, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passi...Show more Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload. Show less
CVE-2022-29557 1Relx 1Firco Compliance Link Jun 17, 2026 Feb 15, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 LexisNexis Firco Compliance Link 3.7 allows CSRF.
CVE-2023-22942 1Splunk 1Splunk Jun 17, 2026 Feb 14, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store colle...Show more In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.Show less
CVE-2023-25065 1Shapedplugin 1Wp Tabs Jun 17, 2026 Feb 14, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.
CVE-2023-24382 1Material Design Icons For Page Builders Project 1Material Design Icons For Page Builders Jun 17, 2026 Feb 14, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.

Previous 1...274275276...484 Next