Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVEs (9,972)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-7433 1Rental Bike Script Project 1Rental Bike Script Jun 17, 2026 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
CVE-2019-7391 1Zyxel 2Dsl 491hnu B10b Firmware Dsl 491hnu B1b V2 Firmware Jun 17, 2026 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
CVE-2019-6967 1Airties 1Air 5341 Firmware Jun 17, 2026 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
CVE-2019-6282 1Chinamobileltd 1Gpn2.4p21 C Cn Firmware Jun 17, 2026 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Passw...Show more ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.Show less
CVE-2018-20648 1Car Rental Script Project 1Car Rental Script Nov 21, 2024 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
CVE-2018-20644 1Basic B2b Script Project 1Basic B2b Script Nov 21, 2024 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.
CVE-2018-20641 1Entrepreneur Job Portal Script Project 1Entrepreneur Job Portal Script Nov 21, 2024 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
CVE-2018-20633 1Advance B2b Script Project 1Advance B2b Script Nov 21, 2024 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
CVE-2018-19525 1Systrome 3Cumilon Isg 600c Firmware Cumilon Isg 600h FirmwareCumilon Isg 800w Firmware Nov 21, 2024 Mar 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of...Show more An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation.Show less
CVE-2018-19511 1Ens 1Webgalamb Nov 21, 2024 Mar 21, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password.
CVE-2018-17996 1Layerbb 1Layerbb Nov 21, 2024 Mar 21, 2019 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.
CVE-2018-14575 1Mybb 1Trash Bin Nov 21, 2024 Mar 21, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.
CVE-2019-9787 1Wordpress 1Wordpress Jun 17, 2026 Mar 14, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search...Show more WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.Show less
CVE-2019-9769 1Kartatopia 1Piluscart Jun 17, 2026 Mar 14, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.
CVE-2019-5924 1Rednao 1Smart Forms Jun 17, 2026 Mar 12, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
CVE-2019-5920 1Ncrafts 1Formcraft Jun 17, 2026 Mar 12, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
CVE-2019-9688 1Sftnow 1Sftnow Jun 17, 2026 Mar 11, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account.
CVE-2019-9652 1Sdcms 1Sdcms Jun 17, 2026 Mar 11, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter.
CVE-2019-9598 1Chshcms 1Cscms Jun 17, 2026 Mar 7, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.
CVE-2019-8437 1Njiandan Cms Project 1Njiandan Cms Jun 17, 2026 Mar 7, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.

Previous 1...396397398...499 Next