Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,946)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-9308 1Weplugins 1Wp Maps May 7, 2025 Aug 14, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
CVE-2015-9307 1Weplugins 1Wp Maps May 7, 2025 Aug 14, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
CVE-2013-7476 1Simple Fields Project 1Simple Fields Nov 21, 2024 Aug 14, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
CVE-2019-11207 1Tibco 22Loglogic Enterprise Virtual Appliance Loglogic Log Management IntelligenceLoglogic Lx1025 Firmware+19 more Jun 17, 2026 Aug 13, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and refl...Show more The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as cross-site request forgery (CSRF) attacks. This issue affects: TIBCO Software Inc. TIBCO LogLogic Enterprise Virtual Appliance version 6.2.1 and prior versions. TIBCO Software Inc. TIBCO LogLogic Log Management Intelligence 6.2.1. TIBCO LogLogic LX825 Appliance 0.0.004, TIBCO LogLogic LX1025 Appliance 0.0.004, TIBCO LogLogic LX4025 Appliance 0.0.004, TIBCO LogLogic MX3025 Appliance 0.0.004, TIBCO LogLogic MX4025 Appliance 0.0.004, TIBCO LogLogic ST1025 Appliance 0.0.004, TIBCO LogLogic ST2025-SAN Appliance 0.0.004, and TIBCO LogLogic ST4025 Appliance 0.0.004 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below. TIBCO LogLogic LX1035 Appliance 0.0.005, TIBCO LogLogic LX1025R1 Appliance 0.0.004, TIBCO LogLogic LX1025R2 Appliance 0.0.004, TIBCO LogLogic LX4025R1 Appliance 0.0.004, TIBCO LogLogic LX4025R2 Appliance 0.0.004, TIBCO LogLogic LX4035 Appliance 0.0.005, TIBCO LogLogic ST2025-SANR1 Appliance 0.0.004, TIBCO LogLogic ST2025-SANR2 Appliance 0.0.004, TIBCO LogLogic ST2035-SAN Appliance 0.0.005, TIBCO LogLogic ST4025R1 Appliance 0.0.004, TIBCO LogLogic ST4025R2 Appliance 0.0.004, and TIBCO LogLogic ST4035 Appliance 0.0.005 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below.Show less
CVE-2018-20964 1Codepeople 1Contact Form Email Nov 21, 2024 Aug 13, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
CVE-2017-18504 1Wpdeveloper 1Twitter Cards Meta Nov 21, 2024 Aug 12, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
CVE-2016-10876 1Wpseeds 1Wp Database Backup Nov 21, 2024 Aug 12, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
CVE-2016-10874 1Wpseeds 1Wp Database Backup Nov 21, 2024 Aug 12, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
CVE-2019-14933 1Webkul 1Bagisto Jun 17, 2026 Aug 11, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Bagisto 0.1.5 allows CSRF under /admin URIs.
CVE-2016-10865 123systems 1Lightbox Plus Colorbox Nov 21, 2024 Aug 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
CVE-2017-18485 1Elementalpath 1Cognitoys Dino Firmware Nov 21, 2024 Aug 8, 2019 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 Cognitoys Dino devices allow profiles_add.html CSRF.
CVE-2016-10863 1Edimax 27237rpd Firmware Ew 7438rpn Mini Firmware Nov 21, 2024 Aug 8, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
CVE-2016-10862 1Neetcables 1Airstream Nas Firmware Nov 21, 2024 Aug 8, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
CVE-2015-9292 16kbbs 16kbbs Nov 21, 2024 Aug 8, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
CVE-2019-14683 1Codection 1Import Users From Csv With Meta Jun 17, 2026 Aug 8, 2019 N/A· v4 5.7 MEDIUM· v3 4.9 MEDIUM· v2 The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
CVE-2019-14682 1Acf\ 1 Better Search Project Jun 17, 2026 Aug 8, 2019 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
CVE-2019-14681 1Deny All Firewall Project 1Deny All Firewall Jun 17, 2026 Aug 8, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
CVE-2019-14680 1Mijnpress 1Admin Renamer Extended Jun 17, 2026 Aug 8, 2019 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
CVE-2019-14679 1Reputeinfosystems 1Arprice Lite Jun 17, 2026 Aug 8, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
CVE-2019-1958 1Cisco 1Hyperflex Hx Data Platform Jun 17, 2026 Aug 8, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerabi...Show more A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.Show less

Previous 1...384385386...498 Next