← Back
CWE-352

9,657 CVEs • Abstraction: Compound • Likelihood of Exploit: Medium

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JSON object

Loading...

CVEs (9,657)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-1432
1Ibm
1Infosphere Information Server
Nov 21, 2024
Jun 5, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Information Server components inside an HTML iframe tag on a mal...Show more
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Information Server components inside an HTML iframe tag on a malicious page. The attacker could use this weakness to devise a Clickjacking attack to conduct phishing, frame sniffing, social engineering or Cross-Site Request Forgery attacks. IBM X-Force ID: 139360.Show less
CVE-2018-11680
1Cmseasy
1Cmseasy
Nov 21, 2024
Jun 2, 2018
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid...Show more
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate.Show less
CVE-2018-11679
1Cmseasy
1Cmseasy
Nov 21, 2024
Jun 2, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admin_dir=admin.
CVE-2018-11538
1Searchblox
1Searchblox
Nov 21, 2024
Jun 1, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
CVE-2018-11671
1Njtech
1Greencms
Nov 21, 2024
Jun 1, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.
CVE-2018-11670
1Njtech
1Greencms
Nov 21, 2024
Jun 1, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.
CVE-2018-11633
1Multidots
1Woo Checkout For Digital Goods
Nov 21, 2024
May 31, 2018
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering)...Show more
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.Show less
CVE-2018-11632
1Multidots
1Add Social Share Messenger Buttons Whatsapp And Viber
Nov 21, 2024
May 31, 2018
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phi...Show more
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.Show less
CVE-2016-10529
1Droppy Project
1Droppy
Nov 21, 2024
May 31, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. Fo...Show more
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.Show less
CVE-2015-7610
2Synacor
Zimbra
2Zimbra Collaboration Suite
Zimbra Collaboration Suite
Nov 21, 2024
May 30, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hija...Show more
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.Show less
CVE-2018-11527
1Cscms Project
1Cscms
Nov 21, 2024
May 29, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpas...Show more
An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save.Show less
CVE-2018-11501
1Website Seller Script Project
1Website Seller Script
Nov 21, 2024
May 26, 2018
N/A· v4
8.8 HIGH· v3
6.0 MEDIUM· v2
PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.
CVE-2018-11500
1Publiccms
1Publiccms
Nov 21, 2024
May 26, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.
CVE-2018-11493
1Wuzhicms
1Wuzhicms
May 5, 2025
May 26, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add.
CVE-2017-9641
1Osisoft
1Pi Coresight
Nov 21, 2024
May 25, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vision 2017 or greater to mitigate this vulnerability.
CVE-2018-11445
1Easyservice Billing Project
1Easyservice Billing
Nov 21, 2024
May 25, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing 1.0. A User can be added with the Admin role.
CVE-2018-11442
1Easyservice Billing Project
1Easyservice Billing
Nov 21, 2024
May 25, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation.
CVE-2018-11405
1Kliqqi
1Kliqqi Cms
Nov 21, 2024
May 24, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Kliqqi 2.0.2 has CSRF in admin/admin_users.php.
CVE-2018-11371
1Skycaiji
1Skycaiji
Nov 21, 2024
May 22, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
SkyCaiji 1.2 allows CSRF to add an Administrator user.
CVE-2018-11096
1Horse Market Sell & Rent Portal Project
1Horse Market Sell & Rent Portal
Nov 21, 2024
May 21, 2018
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.