← Back
CWE-352

9,677 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,677)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-27628
1Wzone Project
1Wzone
Jun 17, 2026
Feb 6, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.
CVE-2023-0674
1Xuxueli
1Xxl Job
Jun 17, 2026
Feb 4, 2023
N/A· v4
6.5 MEDIUM· v3
5.0 MEDIUM· v2
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulat...Show more
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.Show less
CVE-2021-37234
1Modern Honey Network Project
1Modern Honey Network
Jun 17, 2026
Feb 3, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
CVE-2021-36570
1Thedaylightstudio
1Fuel Cms
Jun 17, 2026
Feb 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVE-2021-36569
1Thedaylightstudio
1Fuel Cms
Jun 17, 2026
Feb 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVE-2021-36444
1Txjia
1Imcat
Jun 17, 2026
Feb 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.
CVE-2021-36443
1Txjia
1Imcat
Jun 17, 2026
Feb 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
CVE-2022-47132
1Creativeitem
1Academy Lms
Jun 17, 2026
Feb 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
CVE-2022-47131
1Creativeitem
1Academy Lms
Jun 17, 2026
Feb 3, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
CVE-2022-47130
1Creativeitem
1Academy Lms
Jun 17, 2026
Feb 3, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.
CVE-2022-46842
1Wiselyhub
1Js Help Desk
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.
CVE-2022-46815
1Wptrio
1Conditional Shipping For Woocommerce
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.
CVE-2022-45807
1Wpvibes
1Wp Mail Log
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.
CVE-2022-45067
1Devscred
1Exclusive Addons For Elementor
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions.
CVE-2022-44585
1Magneticlab
1Homepage Pop Up
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
CVE-2022-40692
1Sunshinephotocart
1Sunshine Photo Cart
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.
CVE-2022-36401
1Standalonetech
1Terawallet
Jun 17, 2026
Feb 2, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.
CVE-2023-0642
1Squidex.io
1Squidex
Jun 17, 2026
Feb 2, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
CVE-2023-25015
1Clockwork Web Project
1Clockwork Web
Jun 17, 2026
Feb 2, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
CVE-2023-23750
1Joomla
1Joomla
Jun 17, 2026
Feb 1, 2023
N/A· v4
6.3 MEDIUM· v3
N/A· v2
An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.