CWE-352
9,944 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVEs (9,944)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password. |
1Theaccessgroup 1Corehr Core Portal Jun 17, 2026 Jun 9, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site request forgery. It is possible to launch the att...Show more |
The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack |
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack |
1Tipsandtricks Hq 1Wp Simple Adsense Insertion Jun 17, 2026 Jun 8, 2022 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via...Show more |
1Deliciousbrains 1Database Backup Jun 17, 2026 Jun 8, 2022 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. T...Show more |
1Files Download Delay Project 1Files Download Delay Jun 17, 2026 Jun 8, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action. |
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site. |
The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults. |
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack |
A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch...Show more |
1Deltacontrols 1Entelitouch Firmware Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request. |
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |
1Supsystic 1Social Share Buttons Jun 17, 2026 Jun 2, 2022 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. |
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index. |
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to ch...Show more |
1Ibm 2Business Automation Workflow Business Process ManagerJun 17, 2026 May 31, 2022 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1...Show more |
1Bulk Page Creator Project 1Bulk Page Creator Jun 17, 2026 May 30, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF. |
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings....Show more |
1Content Mask Project 1Content Mask Jun 17, 2026 May 30, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result,...Show more |