← Back
CWE-352

9,658 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,658)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-15832
1Wp Buy
1Visitor Traffic Real Time Statistics
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
CVE-2019-15831
1Wp Buy
1Visitor Traffic Real Time Statistics
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
CVE-2019-15828
1Tribulant
1One Click Ssl
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
CVE-2015-9380
110web
1Photo Gallery
Nov 21, 2024
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
CVE-2019-15781
1Weblizar
1Social Likebox & Feed
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
CVE-2019-15779
1Quadlayers
1Wp Social Feed Gallery
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
CVE-2019-15770
1Hallme
1Woocommerce Address Book
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
CVE-2019-15769
1Haktansuren
1Handl Utm Grabber
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
CVE-2019-10057
1Lexmark
25Cs31x Firmware
Cs41x FirmwareCx310 Firmware+22 more
Jun 17, 2026
Aug 28, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Various Lexmark products have CSRF.
CVE-2019-15496
1Manageyourteam
1Myt Project Management
Jun 17, 2026
Aug 28, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML...Show more
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.Show less
CVE-2019-10384
3Jenkins
OracleRedhat
3Communications Cloud Native Core Automated Test Suite
JenkinsOpenshift Container Platform
Jun 17, 2026
Aug 28, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for th...Show more
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.Show less
CVE-2019-11457
1Micropyramid
1Django Crm
Jun 17, 2026
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportun...Show more
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.Show less
CVE-2019-15660
1Butlerblog
1Wp Members
Jun 17, 2026
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-members plugin before 3.2.8 for WordPress has CSRF.
CVE-2019-15648
1Elearningfreak
1Insert Or Embed Articulate Content
Jun 17, 2026
Aug 27, 2019
N/A· v4
6.5 MEDIUM· v3
5.5 MEDIUM· v2
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
CVE-2019-15645
1Zoho
1Salesiq
Jun 17, 2026
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
CVE-2018-21006
1Bbpress Move Topics Project
1Bbpress Move Topics
Nov 21, 2024
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
CVE-2018-21002
1Joomsky
1Js Help Desk
Nov 21, 2024
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
CVE-2015-9343
1Impress
1Wp Rollback
Nov 21, 2024
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
CVE-2019-15515
1Discourse
1Discourse
Jun 17, 2026
Aug 26, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Discourse 2.3.2 sends the CSRF token in the query string.
CVE-2019-8447
1Atlassian
1Jira Server
Jun 17, 2026
Aug 23, 2019
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.