← Back
CWE-352

9,658 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,658)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-16658
1Tuzicms
1Tuzicms
Jun 17, 2026
Sep 21, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
CVE-2018-17789
1Prospecta
1Master Data Online
Nov 21, 2024
Sep 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Prospecta Master Data Online (MDO) allows CSRF.
CVE-2015-9408
1Cyberseo
1Xpinner Lite
Nov 21, 2024
Sep 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
CVE-2015-9394
1Usersultra
1Users Ultra Membership
Nov 21, 2024
Sep 20, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
CVE-2016-10997
1Yourinspirationweb
1Beauty Premium
Nov 21, 2024
Sep 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
CVE-2015-9388
1Mtouch Quiz Project
1Mtouch Quiz
Nov 21, 2024
Sep 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
CVE-2015-9387
1Mtouch Quiz Project
1Mtouch Quiz
Nov 21, 2024
Sep 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
CVE-2019-15089
1Prise
1Adas
Jun 17, 2026
Sep 20, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.
CVE-2019-16531
1Layerbb
1Layerbb
Jun 17, 2026
Sep 20, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVE-2016-10989
1Leenk
1Leenk.me
Nov 21, 2024
Sep 17, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
CVE-2016-10982
1Kentothemes
1Kento Post View Counter
Nov 21, 2024
Sep 17, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
CVE-2016-10978
1Fossura
1Tag Miner
Nov 21, 2024
Sep 17, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
CVE-2016-10974
1Tonjoostudio
1Fluid Responsive Slideshow
Nov 21, 2024
Sep 17, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
CVE-2016-10962
1Icegram
1Icegram Engage
Nov 21, 2024
Sep 16, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
CVE-2019-16311
1Niushop
1Niushop
Jun 17, 2026
Sep 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
NIUSHOP V1.11 has CSRF via search_info to index.php.
CVE-2019-13920
1Siemens
1Sinema Remote Connect Server
Jun 17, 2026
Sep 13, 2019
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cross Site Request Forgery (CSRF) attacks. The security vulnerabi...Show more
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cross Site Request Forgery (CSRF) attacks. The security vulnerability could be exploited by an attacker that is able to trigger requests of a logged-in user to the application. The vulnerability could allow switching the connectivity state of a user or a device. At the time of advisory publication no public exploitation of this security vulnerability was known.Show less
CVE-2019-13364
1Piwigo
1Piwigo
Jun 17, 2026
Sep 13, 2019
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat&#95;number, billing&#95;name, company, or billing&#95;address parameter. This is exploitable via CSRF.
CVE-2019-13363
1Piwigo
1Piwigo
Jun 17, 2026
Sep 13, 2019
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm&#95;send&#95;html&#95;mail, nbm&#95;send&#95;mail&#95;as, nbm&#95;send&#95;detailed&#95;content, nbm&#95;complementary&#95;mail&#95;content, nbm&#95...Show more
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm&#95;send&#95;html&#95;mail, nbm&#95;send&#95;mail&#95;as, nbm&#95;send&#95;detailed&#95;content, nbm&#95;complementary&#95;mail&#95;content, nbm&#95;send&#95;recent&#95;post&#95;dates, or param&#95;submit parameter. This is exploitable via CSRF.Show less
CVE-2019-12922
2Fedoraproject
Phpmyadmin
2Fedora
Phpmyadmin
Jun 17, 2026
Sep 13, 2019
N/A· v4
6.5 MEDIUM· v3
5.8 MEDIUM· v2
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
CVE-2016-10946
1Wp D3 Project
1Wp D3
Nov 21, 2024
Sep 13, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.