Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for reques…

CVE-2015-2009HIGHCVSS 8.8EG 8.8

2018-03-29

Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for …

CVE-2015-20105CRITICALCVSS 9.6EG 9.6

2021-12-02

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are ou…

CVE-2015-2039NONECVSS 0.0EG 0.0

2015-02-20

Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings o…

CVE-2015-2048NONECVSS 0.0EG 0.0

2015-02-23

Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-2083NONECVSS 0.0EG 0.0

2015-02-25

Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php.

CVE-2015-2084NONECVSS 0.0EG 0.0

2015-02-25

Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks …

CVE-2015-2089NONECVSS 0.0EG 0.0

2015-02-26

Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that…

CVE-2015-2293NONECVSS 0.0EG 0.0

2015-03-17

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hija…

CVE-2015-2334NONECVSS 0.0EG 0.0

2015-03-18

Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-2350NONECVSS 0.0EG 0.0

2015-03-19

Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status pag…

CVE-2015-2676NONECVSS 0.0EG 0.0

2015-03-23

Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a r…

CVE-2015-2680NONECVSS 0.0EG 0.0

2015-03-23

Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gx…

CVE-2015-2701NONECVSS 0.0EG 0.0

2015-03-25

Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.

CVE-2015-2755NONECVSS 0.0EG 0.0

2015-04-01

Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scri…

CVE-2015-2759NONECVSS 0.0EG 0.0

2015-03-27

Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for reques…

CVE-2015-2769NONECVSS 0.0EG 0.0

2015-03-27

Multiple cross-site request forgery (CSRF) vulnerabilities in the Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-2770NONECVSS 0.0EG 0.0

2015-03-27

Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-2838NONECVSS 0.0EG 0.0

2015-04-03

Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via she…

CVE-2015-3140HIGHCVSS 8.8EG 8.8

2019-11-21

Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567

CVE-2015-4179HIGHCVSS 8.8EG 8.8

2018-02-05

Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.

CVE-2015-4630HIGHCVSS 8.0EG 8.0

2018-10-18

Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for …

CVE-2015-5483HIGHCVSS 8.8EG 8.8

2020-01-28

Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modif…

CVE-2015-5595MEDIUMCVSS 6.5EG 6.5

2019-12-31

Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).

CVE-2015-5686HIGHCVSS 8.8EG 8.8

2020-02-27

Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.

CVE-2015-7610HIGHCVSS 8.8EG 8.8

2018-05-30

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authenticati…

CVE-2015-8536HIGHCVSS 8.8EG 8.8

2020-03-27

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow cross-site …

CVE-2015-9284HIGHCVSS 8.8EG 8.8

2019-04-26

The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedba…

CVE-2015-9292HIGHCVSS 8.8EG 8.8

2019-08-08

6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).

CVE-2015-9307HIGHCVSS 8.8EG 8.8

2019-08-14

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.

CVE-2015-9308HIGHCVSS 8.8EG 8.8

2019-08-14

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.

CVE-2015-9309HIGHCVSS 8.8EG 8.8

2019-08-14

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.

CVE-2015-9322HIGHCVSS 8.8EG 8.8

2019-08-16

The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.

CVE-2015-9332MEDIUMCVSS 6.5EG 6.5

2019-08-20

The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.

CVE-2015-9343HIGHCVSS 8.8EG 8.8

2019-08-27

The wp-rollback plugin before 1.2.3 for WordPress has CSRF.

CVE-2015-9380HIGHCVSS 8.8EG 8.8

2019-08-30

The photo-gallery plugin before 1.2.42 for WordPress has CSRF.

CVE-2015-9387MEDIUMCVSS 6.5EG 6.5

2019-09-20

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.

CVE-2015-9388MEDIUMCVSS 6.5EG 6.5

2019-09-20

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.

CVE-2015-9394HIGHCVSS 8.8EG 8.8

2019-09-20

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

CVE-2015-9408MEDIUMCVSS 6.5EG 6.5

2019-09-20

The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.

CVE-2015-9409MEDIUMCVSS 6.5EG 6.5

2019-09-25

The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.

CVE-2015-9413MEDIUMCVSS 6.5EG 6.5

2019-09-26

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.

CVE-2015-9417MEDIUMCVSS 6.5EG 6.5

2019-09-26

The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.

CVE-2015-9418MEDIUMCVSS 4.3EG 4.3

2019-09-26

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CVE-2015-9421MEDIUMCVSS 6.5EG 6.5

2019-09-26

The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.

CVE-2015-9422MEDIUMCVSS 6.5EG 6.5

2019-09-26

The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin,…

CVE-2015-9424MEDIUMCVSS 6.5EG 6.5

2019-09-26

The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.

CVE-2015-9425MEDIUMCVSS 5.4EG 5.4

2019-09-26

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.

CVE-2015-9427MEDIUMCVSS 6.5EG 6.5

2019-09-26

The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.

CVE-2015-9428MEDIUMCVSS 6.5EG 6.5

2019-09-26

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parame…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 21 of 173

Map vulnerabilities like CWE-352 to your infrastructure