← Back
CWE-352

9,946 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,946)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-15128
1If.svnadmin Project
1If.svnadmin
Jun 17, 2026
Sep 6, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user.
CVE-2019-16059
1Sapplica
1Sentrifugo
Jun 17, 2026
Sep 6, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page.
CVE-2019-15868
1Wpaffiliatemanager
1Affiliates Manager
Jun 17, 2026
Sep 3, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
CVE-2019-15865
1Holest
1Breadcrumbs By Menu
Jun 17, 2026
Sep 3, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
CVE-2019-15841
1Facebook
1Facebook For Woocommerce
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
CVE-2019-15840
1Facebook
1Facebook For Woocommerce
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
CVE-2019-15835
1Wp Better Permalinks Project
1Wp Better Permalinks
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
CVE-2019-15834
1Webp Converter For Media Project
1Webp Converter For Media
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
CVE-2019-15832
1Wp Buy
1Visitor Traffic Real Time Statistics
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
CVE-2019-15831
1Wp Buy
1Visitor Traffic Real Time Statistics
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
CVE-2019-15828
1Tribulant
1One Click Ssl
Jun 17, 2026
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
CVE-2015-9380
110web
1Photo Gallery
Nov 21, 2024
Aug 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
CVE-2019-15781
1Weblizar
1Social Likebox & Feed
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
CVE-2019-15779
1Quadlayers
1Wp Social Feed Gallery
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
CVE-2019-15770
1Hallme
1Woocommerce Address Book
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
CVE-2019-15769
1Haktansuren
1Handl Utm Grabber
Jun 17, 2026
Aug 29, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
CVE-2019-10057
1Lexmark
25Cs31x Firmware
Cs41x FirmwareCx310 Firmware+22 more
Jun 17, 2026
Aug 28, 2019
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Various Lexmark products have CSRF.
CVE-2019-15496
1Manageyourteam
1Myt Project Management
Jun 17, 2026
Aug 28, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML...Show more
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.Show less
CVE-2019-10384
3Jenkins
OracleRedhat
3Communications Cloud Native Core Automated Test Suite
JenkinsOpenshift Container Platform
Jun 17, 2026
Aug 28, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for th...Show more
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.Show less
CVE-2019-11457
1Micropyramid
1Django Crm
Jun 17, 2026
Aug 27, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportun...Show more
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.Show less