CWE-352— Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.— MITRE CWE catalog

9,686 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-352page 20 of 194

CVE-2023-41730HIGHCVSS 8.8EG 8.8
2023-10-10
Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
CVE-2023-41697HIGHCVSS 8.8EG 8.8
2023-10-10
Cross-Site Request Forgery (CSRF) vulnerability in Nikunj Soni Easy WP Cleaner plugin <= 1.9 versions.
CVE-2023-41694HIGHCVSS 8.8EG 8.8
2023-10-10
Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions.
CVE-2023-41684HIGHCVSS 8.8EG 8.8
2023-10-10
Cross-Site Request Forgery (CSRF) vulnerability in Felix Welberg SIS Handball plugin <= 1.0.45 versions.
CVE-2023-44811HIGHCVSS 8.8EG 8.8
2023-10-09
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.
CVE-2023-41672HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions.
CVE-2023-41670HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel (in person: Edward Bock) Use Memcached plugin <= 1.0.4 versions.
CVE-2023-41669HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.
CVE-2023-41668HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.
CVE-2023-41667HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.
CVE-2023-41660HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in WPSynchro WP Synchro plugin <= 1.9.1 versions.
CVE-2023-44993HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions.
CVE-2023-44473HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions.
CVE-2023-44240HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions.
CVE-2023-44246HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.
CVE-2023-44238HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions.
CVE-2023-44237HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.
CVE-2023-44236HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions.
CVE-2023-44260HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions.
CVE-2023-44232HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.
CVE-2023-44231HIGHCVSS 8.8EG 8.8
2023-10-09
Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.
CVE-2023-44243HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.
CVE-2023-44233HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.
CVE-2023-44146HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions.
CVE-2023-41950HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.
CVE-2023-41801HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.
CVE-2023-41732HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions.
CVE-2023-41659HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.
CVE-2023-41654HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions.
CVE-2023-41650HIGHCVSS 8.8EG 8.8
2023-10-06
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <= 2.1 versions.
CVE-2023-41693HIGHCVSS 8.8EG 8.8
2023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions.
CVE-2023-41244HIGHCVSS 8.8EG 8.8
2023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in Buildfail Localize Remote Images plugin <= 1.0.9 versions.
CVE-2023-41086HIGHCVSS 8.8EG 8.8
2023-10-03
Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, unintended operations may be performed. Affected products and versions are as fol…
CVE-2023-41452HIGHCVSS 8.8EG 8.8
2023-09-27
Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
CVE-2023-35793HIGHCVSS 8.8EG 8.8
2023-09-27
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (CSRF) attacks.
CVE-2023-43278HIGHCVSS 8.8EG 8.8
2023-09-25
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
CVE-2023-3547HIGHCVSS 8.8EG 8.8
2023-09-25
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
CVE-2023-42321HIGHCVSS 8.8EG 8.8
2023-09-20
Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
CVE-2023-43500HIGHCVSS 8.8EG 8.8
2023-09-20
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVE-2023-5036HIGHCVSS 8.8EG 8.8
2023-09-18
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
CVE-2023-42270HIGHCVSS 8.8EG 8.8
2023-09-15
Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF).
CVE-2023-40868HIGHCVSS 8.8EG 8.8
2023-09-14
Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions.
CVE-2023-4916HIGHCVSS 8.8EG 8.8
2023-09-13
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possi…
CVE-2023-4869HIGHCVSS 8.8EG 8.8
2023-09-10
A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The a…
CVE-2023-4868HIGHCVSS 8.8EG 8.8
2023-09-10
A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery.…
CVE-2023-4865HIGHCVSS 8.8EG 8.8
2023-09-09
A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The expl…
CVE-2023-40953HIGHCVSS 8.8EG 8.8
2023-09-08
icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).
CVE-2015-1391HIGHCVSS 8.8EG 8.8
2023-09-05
Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
CVE-2023-40341HIGHCVSS 8.8EG 8.8
2023-08-16
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.
CVE-2023-40336HIGHCVSS 8.8EG 8.8
2023-08-16
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.

Map vulnerabilities like CWE-352 to your infrastructure

EchelonGraph correlates every CVE — across CWE-352 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →