CWE-352
9,658 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVEs (9,658)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Yithemes 1Yith Maintenance Mode Nov 21, 2024 Sep 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter. |
1Wplegalpages 1Wp Legal Pages Nov 21, 2024 Sep 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address,...Show more |
1Googmonify Project 1Googmonify Nov 21, 2024 Sep 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter. |
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter. |
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter. |
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, Plu...Show more |
1Olevmedia 1Olevmedia Shortcodes Nov 21, 2024 Sep 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. |
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. |
1Slidervilla 1Testimonial Slider Nov 21, 2024 Sep 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. |
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. |
1Alo Easymail Project 1Alo Easymail Nov 21, 2024 Sep 25, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. |
1Jenkins 1Project Inheritance Jun 17, 2026 Sep 25, 2019 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates. |
1Ibm 1Security Key Lifecycle Manager Jun 17, 2026 Sep 24, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IB...Show more |
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. |
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. |
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php. |
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. |
joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. |
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. |