CWE-352— Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.— MITRE CWE catalog
8,843 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-352page 91 of 177
- CVE-2023-35913MEDIUMCVSS 4.3EG 4.32023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions.
- CVE-2023-35917MEDIUMCVSS 4.3EG 4.32023-06-22
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
- CVE-2023-36162HIGHCVSS 8.8EG 8.82023-07-03
Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.
- CVE-2023-36237HIGHCVSS 8.8EG 8.82024-02-26
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
- CVE-2023-36256MEDIUMCVSS 6.5EG 6.52023-07-07
The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without …
- CVE-2023-3627HIGHCVSS 8.8EG 8.12023-07-11
Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.
- CVE-2023-36511MEDIUMCVSS 4.3EG 4.32023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.
- CVE-2023-36513MEDIUMCVSS 5.4EG 5.42023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.
- CVE-2023-36514MEDIUMCVSS 6.5EG 6.52023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
- CVE-2023-36517MEDIUMCVSS 4.3EG 4.32023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.
- CVE-2023-36522MEDIUMCVSS 4.3EG 4.32023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in WePupil Quiz Expert plugin <= 1.5.0 versions.
- CVE-2023-36682HIGHCVSS 7.1EG 7.12023-11-30
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.
- CVE-2023-36685MEDIUMCVSS 4.3EG 4.32023-11-30
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
- CVE-2023-36687MEDIUMCVSS 5.4EG 5.42023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <= 5.8.2 versions.
- CVE-2023-36690HIGHCVSS 8.1EG 8.12023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.
- CVE-2023-36691MEDIUMCVSS 5.4EG 5.42023-07-10
Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions.
- CVE-2023-36693MEDIUMCVSS 4.3EG 4.32023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <= 1.1 versions.
- CVE-2023-37131MEDIUMCVSS 6.5EG 6.52023-07-06
A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.
- CVE-2023-3720MEDIUMCVSS 6.5EG 6.52023-08-30
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html ca…
- CVE-2023-37277CRITICALCVSS 9.6EG 9.62023-07-10
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-u…
- CVE-2023-37386MEDIUMCVSS 5.4EG 5.42023-07-18
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.
- CVE-2023-37387MEDIUMCVSS 5.4EG 5.42023-07-18
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
- CVE-2023-37391MEDIUMCVSS 5.4EG 5.42023-07-11
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.
- CVE-2023-37392MEDIUMCVSS 5.4EG 5.42023-07-10
Cross-Site Request Forgery (CSRF) vulnerability in Deepak Anand WP Dummy Content Generator plugin <= 2.3.0 versions.
- CVE-2023-37562HIGHCVSS 8.8EG 8.82023-07-13
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
- CVE-2023-37596HIGHCVSS 8.1EG 8.12023-07-11
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
- CVE-2023-37597HIGHCVSS 8.1EG 8.12023-07-11
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.
- CVE-2023-37598MEDIUMCVSS 4.5EG 4.52023-07-13
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
- CVE-2023-3764MEDIUMCVSS 4.3EG 4.32023-08-31
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possibl…
- CVE-2023-37650HIGHCVSS 8.8EG 8.82023-07-20
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
- CVE-2023-37889MEDIUMCVSS 4.3EG 4.32023-07-18
Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.
- CVE-2023-37891MEDIUMCVSS 4.3EG 4.32023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions.
- CVE-2023-37892MEDIUMCVSS 4.3EG 4.32023-07-18
Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.
- CVE-2023-37952MEDIUMCVSS 6.5EG 6.52023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing creden…
- CVE-2023-37954MEDIUMCVSS 4.3EG 4.32023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build.
- CVE-2023-37955MEDIUMCVSS 6.5EG 6.52023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
- CVE-2023-37957HIGHCVSS 8.8EG 8.82023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token.
- CVE-2023-37958HIGHCVSS 8.8EG 8.82023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL.
- CVE-2023-37961HIGHCVSS 8.8EG 8.82023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account.
- CVE-2023-37962HIGHCVSS 8.8EG 8.82023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on …
- CVE-2023-37964HIGHCVSS 8.8EG 8.82023-07-12
A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturin…
- CVE-2023-37968MEDIUMCVSS 5.4EG 5.42023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions.
- CVE-2023-37973MEDIUMCVSS 5.4EG 5.42023-07-18
Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.
- CVE-2023-37974MEDIUMCVSS 5.4EG 5.42023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.
- CVE-2023-37985MEDIUMCVSS 4.3EG 4.32023-07-17
Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.
- CVE-2023-37990MEDIUMCVSS 4.3EG 4.32023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.
- CVE-2023-37991MEDIUMCVSS 4.3EG 4.32023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions.
- CVE-2023-37992MEDIUMCVSS 5.4EG 5.42023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
- CVE-2023-37995MEDIUMCVSS 4.3EG 4.32023-10-04
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.
- CVE-2023-37996MEDIUMCVSS 5.4EG 5.42023-10-03
Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions.
Map vulnerabilities like CWE-352 to your infrastructure
EchelonGraph correlates every CVE — across CWE-352 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →