CWE-352
9,945 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVEs (9,945)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
2Debian Trilexnet2Debian Linux LetodmsNov 21, 2024 Nov 13, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 letodms 3.3.6 has CSRF via change password |
1Redhat 2Jboss Enterprise Web Server KeycloakNov 21, 2024 Nov 13, 2019 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password. |
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. |
1Zohocorp 1Manageengine Adselfservice Plus Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and...Show more |
An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. |
Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions. |
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution...Show more |
2Debian Horde2Debian Linux GroupwareNov 21, 2024 Nov 5, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. |
3Debian HordeOpensuse3Debian Linux GroupwareOpensuseNov 21, 2024 Nov 5, 2019 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions |
2Debian Horde2Debian Linux GroupwareNov 21, 2024 Nov 5, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book |
1Oneidentity 1Cloud Access Manager Jun 17, 2026 Nov 4, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests. |
A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload. |
An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSRF vulnerability. |
Tiki Wiki CMS Groupware 5.2 has CSRF |
TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities. |
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploitation could lead to sensitive information disclosure. |
1Sourcecodester 1Restaurant Management System Jun 17, 2026 Oct 24, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator...Show more |
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags co...Show more |
1Darktrace 1Enterprise Immune System Jun 17, 2026 Oct 23, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint. |