Vulnerabilities (CVE)

Filtered by CWE-352
Total 7833 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-5030 1 Cminds 1 Cm Table Of Contents 2025-05-15 N/A 3.8 LOW
The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2022-42086 1 Tenda 2 Ax1803, Ax1803 Firmware 2025-05-15 N/A 6.5 MEDIUM
Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode.
CVE-2022-41500 1 Eyoucms 1 Eyoucms 2025-05-15 N/A 8.8 HIGH
EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components.
CVE-2022-41489 1 Wayos 12 Lq-04, Lq-04 Firmware, Lq-05 and 9 more 2025-05-15 N/A 8.1 HIGH
WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usb_upload.htm.
CVE-2022-35611 1 Bevywise 1 Mqttroute 2025-05-15 N/A 4.3 MEDIUM
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
CVE-2024-5029 1 Cminds 1 Cm Table Of Contents 2025-05-15 N/A 4.8 MEDIUM
The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8157 1 Web-argument 1 Alphabetical List 2025-05-15 N/A 4.3 MEDIUM
The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-41475 1 Rpcms 1 Rpcms 2025-05-15 N/A 8.8 HIGH
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account.
CVE-2022-41474 1 Rpcms 1 Rpcms 2025-05-15 N/A 6.5 MEDIUM
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account.
CVE-2024-3405 1 Goprayer 1 Wp Prayer 2025-05-15 N/A 7.6 HIGH
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-3406 1 Goprayer 1 Wp Prayer 2025-05-15 N/A 8.8 HIGH
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-3407 1 Goprayer 1 Wp Prayer 2025-05-15 N/A 5.3 MEDIUM
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-3629 1 Dachande663 1 Hl Twitter 2025-05-15 N/A 2.4 LOW
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-3631 1 Dachande663 1 Hl Twitter 2025-05-15 N/A 4.3 MEDIUM
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack
CVE-2024-3823 1 Mranderson 1 Base64 Encoderdecoder 2025-05-15 N/A 2.4 LOW
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-3824 1 Mranderson 1 Base64 Encoderdecoder 2025-05-15 N/A 5.5 MEDIUM
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
CVE-2025-4282 1 Oretnom23 1 Stock Management System 2025-05-14 5.0 MEDIUM 4.3 MEDIUM
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-50930 1 Savignano 1 S-notify 2025-05-14 N/A 8.3 HIGH
An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.
CVE-2024-10892 1 Stylemixthemes 1 Cost Calculator Builder 2025-05-14 N/A 5.4 MEDIUM
The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
CVE-2025-2907 1 Tychesoftwares 1 Order Delivery Date Pro For Woocommerce 2025-05-14 N/A 9.8 CRITICAL
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.