CWE-352— Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.— MITRE CWE catalog
8,840 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-352page 58 of 177
- CVE-2021-25053HIGHCVSS 8.8EG 8.82022-01-10
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- CVE-2021-25072MEDIUMCVSS 6.5EG 6.52022-02-01
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- CVE-2021-25073HIGHCVSS 8.8EG 8.82022-01-24
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
- CVE-2021-25081MEDIUMCVSS 6.5EG 6.52022-02-28
The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a C…
- CVE-2021-25092MEDIUMCVSS 6.5EG 6.52022-02-01
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
- CVE-2021-25095HIGHCVSS 7.1EG 7.12022-02-07
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block…
- CVE-2021-25097MEDIUMCVSS 6.5EG 6.52022-02-01
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
- CVE-2021-25098MEDIUMCVSS 6.5EG 6.52022-03-07
The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in…
- CVE-2021-25108HIGHCVSS 7.1EG 7.12022-02-07
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them a…
- CVE-2021-25116MEDIUMCVSS 6.5EG 6.52022-06-13
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as…
- CVE-2021-25117MEDIUMCVSS 4.8EG 4.82024-01-16
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administ…
- CVE-2021-25326MEDIUMCVSS 5.4EG 5.42021-04-09
Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_version.asp. If Wi-Fi is connected but an unauthenticated user visits a URL, the SSID password and web UI password may be …
- CVE-2021-25327MEDIUMCVSS 6.5EG 6.52021-04-09
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are…
- CVE-2021-25765HIGHCVSS 8.8EG 8.82021-02-03
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
- CVE-2021-25924HIGHCVSS 8.8EG 8.82021-04-01
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup c…
- CVE-2021-25930MEDIUMCVSS 4.3EG 4.32021-05-20
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.…
- CVE-2021-25931HIGHCVSS 8.8EG 8.82021-05-20
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.…
- CVE-2021-25965HIGHCVSS 8.8EG 8.82021-11-16
In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credenti…
- CVE-2021-25976HIGHCVSS 8.1EG 8.12021-11-16
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a medi…
- CVE-2021-26033MEDIUMCVSS 6.5EG 6.52021-05-26
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
- CVE-2021-26034MEDIUMCVSS 6.5EG 6.52021-05-26
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
- CVE-2021-26071LOWCVSS 3.5EG 3.52021-04-01
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira …
- CVE-2021-26215MEDIUMCVSS 4.3EG 4.32021-03-18
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
- CVE-2021-26216MEDIUMCVSS 4.3EG 4.32021-03-18
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
- CVE-2021-26296HIGHCVSS 7.5EG 7.52021-02-19
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that li…
- CVE-2021-26474HIGHCVSS 8.6EG 8.82021-06-08
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
- CVE-2021-26800MEDIUMCVSS 6.5EG 6.52021-12-16
Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.
- CVE-2021-26960HIGHCVSS 8.8EG 8.82021-03-05
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauth…
- CVE-2021-26961HIGHCVSS 8.8EG 8.82021-03-05
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauth…
- CVE-2021-27181HIGHCVSS 8.8EG 8.82021-04-14
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and …
- CVE-2021-27557MEDIUMCVSS 4.3EG 4.32021-08-31
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
- CVE-2021-27701MEDIUMCVSS 4.7EG 4.72024-11-12
SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending …
- CVE-2021-27704MEDIUMCVSS 6.5EG 6.52024-11-12
Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page.
- CVE-2021-27758MEDIUMCVSS 4.3EG 6.52022-05-06
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.
- CVE-2021-27759LOWCVSS 2.3EG 6.52022-05-06
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary …
- CVE-2021-27885HIGHCVSS 8.8EG 8.82021-03-02
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
- CVE-2021-27927HIGHCVSS 8.8EG 8.82021-03-03
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controlle…
- CVE-2021-28070MEDIUMCVSS 4.3EG 4.32021-08-25
Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
- CVE-2021-28280MEDIUMCVSS 6.1EG 6.12021-04-29
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
- CVE-2021-28490HIGHCVSS 8.8EG 8.82021-08-19
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.
- CVE-2021-28656MEDIUMCVSS 5.4EG 5.42024-04-09
Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
- CVE-2021-29050HIGHCVSS 8.8EG 8.82024-02-20
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social…
- CVE-2021-29054HIGHCVSS 8.8EG 8.82021-04-13
Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro through 6.0.1. The impact is: gain privileges (remote).
- CVE-2021-29238HIGHCVSS 8.8EG 8.82021-05-03
CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).
- CVE-2021-29334HIGHCVSS 8.8EG 8.82022-11-23
An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
- CVE-2021-29349MEDIUMCVSS 6.5EG 6.52021-03-31
Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipi…
- CVE-2021-29400MEDIUMCVSS 6.5EG 6.52021-08-10
A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visi…
- CVE-2021-29435HIGHCVSS 8.1EG 8.12021-04-13
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a vic…
- CVE-2021-29436MEDIUMCVSS 5.4EG 5.42021-04-13
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user ma…
- CVE-2021-29624MEDIUMCVSS 6.5EG 6.52021-05-19
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple s…
Map vulnerabilities like CWE-352 to your infrastructure
EchelonGraph correlates every CVE — across CWE-352 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →