Vulnerabilities (CVE)

Filtered by CWE-352
Total 7856 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2025-5185 2025-05-28 5.0 MEDIUM 4.3 MEDIUM
A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVE-2025-48740 2025-05-28 N/A N/A
A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic authentication.
CVE-2025-44185 1 Mayurik 1 Best Employee Management System 2025-05-28 N/A 5.4 MEDIUM
SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.
CVE-2024-5808 1 Masdiblogs 1 Wp Ajax Contact Form 2025-05-28 N/A 4.3 MEDIUM
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2024-48191 1 Timgreen 1 Dingfanzu Cms 2025-05-27 N/A 6.3 MEDIUM
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17
CVE-2024-48291 1 Timgreen 1 Dingfanzu Cms 2025-05-27 N/A 6.3 MEDIUM
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17
CVE-2023-7229 1 Evanliewer 1 Illi Link Party\! 2025-05-27 N/A 5.5 MEDIUM
The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVE-2024-8090 1 Justintadlock 1 Javascript-logic 2025-05-27 N/A 6.1 MEDIUM
The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8094 1 Ionutstaicu 1 Ntz Atispam 2025-05-27 N/A 6.5 MEDIUM
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-48758 1 Timgreen 1 Dingfanzu Cms 2025-05-27 N/A 6.1 MEDIUM
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a remote attacker to execute arbitrary code
CVE-2024-46911 1 Apache 1 Roller 2025-05-27 N/A 4.7 MEDIUM
Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4. Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue. Roller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw
CVE-2022-41249 1 Jenkins 1 Scm Httpclient 2025-05-27 N/A 8.8 HIGH
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-23685 1 Arubanetworks 1 Clearpass Policy Manager 2025-05-27 N/A 8.8 HIGH
A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.
CVE-2024-46485 1 Timgreen 1 Dingfanzu Cms 2025-05-27 N/A 6.3 MEDIUM
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate
CVE-2024-46600 1 Timgreen 1 Dingfanzu Cms 2025-05-27 N/A 4.7 MEDIUM
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31
CVE-2023-50900 1 Averta 1 Master Slider 2025-05-27 N/A 4.3 MEDIUM
Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10.
CVE-2024-6490 1 Averta 1 Master Slider 2025-05-27 N/A 6.5 MEDIUM
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
CVE-2024-31374 1 Apppresser 1 Apppresser 2025-05-27 N/A 4.3 MEDIUM
Cross-Site Request Forgery (CSRF) vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.
CVE-2024-31268 1 Apppresser 1 Apppresser 2025-05-27 N/A 4.3 MEDIUM
Cross-Site Request Forgery (CSRF) vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.
CVE-2025-44186 1 Mayurik 1 Best Employee Management System 2025-05-27 N/A 5.4 MEDIUM
SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page.