← Back
CWE-352

9,946 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,946)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-18546
1Jayj Quicktag Project
1Jayj Quicktag
Nov 21, 2024
Aug 16, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
CVE-2017-18544
1Invite Anyone Project
1Invite Anyone
Nov 21, 2024
Aug 16, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
CVE-2015-9322
1Erident Custom Login And Dashboard Project
1Erident Custom Login And Dashboard
Nov 21, 2024
Aug 16, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
CVE-2019-13516
1Osisoft
1Pi Web Api
Jun 17, 2026
Aug 15, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
CVE-2018-14668
1Clickhouse
1Clickhouse
Jun 25, 2025
Aug 15, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
CVE-2019-15062
1Dolibarr
1Dolibarr Erp/crm
Jun 17, 2026
Aug 14, 2019
N/A· v4
8.0 HIGH· v3
6.0 MEDIUM· v2
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over...Show more
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)Show less
CVE-2019-14526
1Netgear
1Mr1100 Firmware
Jun 17, 2026
Aug 14, 2019
N/A· v4
8.1 HIGH· v3
5.8 MEDIUM· v2
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in...Show more
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.Show less
CVE-2019-14216
1Wp Svg Icons Project
1Wp Svg Icons
Jun 17, 2026
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP a...Show more
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.Show less
CVE-2019-10199
1Redhat
1Keycloak
Jun 17, 2026
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request fr...Show more
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.Show less
CVE-2018-20968
1Smackcoders
1Ultimate Exporter
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
CVE-2018-20967
1Smackcoders
1Import All Pages, Post Types, Products, Orders, And Users As Xml & Csv
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
CVE-2017-18513
1Expresstech
1Responsive Menu
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
CVE-2017-18512
1Supsystic
1Newsletter By Supsystic
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
CVE-2017-18511
1Wpmudev
1Custom Sidebars
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
CVE-2017-18510
1Wpmudev
1Custom Sidebars
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
CVE-2016-10885
1Benjaminrojas
1Wp Editor
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
CVE-2016-10884
1Simple Membership Plugin
1Simple Membership
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
CVE-2016-10883
1Mijnpress
1Simple Add Pages Or Posts
Nov 21, 2024
Aug 14, 2019
N/A· v4
6.5 MEDIUM· v3
5.8 MEDIUM· v2
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
CVE-2016-10882
1Google Doc Embedder Project
1Google Doc Embedder
Nov 21, 2024
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
CVE-2015-9309
1Weplugins
1Wp Maps
May 7, 2025
Aug 14, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.