CWE-352— Cross-Site Request Forgery (CSRF)

CVE-2015-9432MEDIUMCVSS 6.5EG 6.5

The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.

CVE-2015-9433MEDIUMCVSS 6.5EG 6.5

The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.

CVE-2015-9434MEDIUMCVSS 6.5EG 6.5

The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fad…

CVE-2015-9437MEDIUMCVSS 6.5EG 6.5

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.

CVE-2015-9440MEDIUMCVSS 6.5EG 6.5

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.

CVE-2015-9441MEDIUMCVSS 6.5EG 6.5

The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.

CVE-2015-9442MEDIUMCVSS 6.5EG 6.5

The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.

CVE-2015-9443MEDIUMCVSS 6.5EG 6.5

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.

CVE-2015-9445HIGHCVSS 8.8EG 8.8

The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.

CVE-2015-9447MEDIUMCVSS 6.5EG 6.5

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.

CVE-2015-9455HIGHCVSS 8.1EG 8.1

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.

2019-10-07

The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.

CVE-2015-9497HIGHCVSS 8.8EG 8.8

2019-10-22

The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.

CVE-2015-9498HIGHCVSS 8.8EG 8.8

2019-10-22

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.

CVE-2016-0272HIGHCVSS 8.0EG 8.0

2018-03-09

Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1…

CVE-2016-0295HIGHCVSS 8.8EG 8.8

2018-02-28

Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: …

CVE-2016-0335HIGHCVSS 8.8EG 8.8

2018-01-12

Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that h…

CVE-2016-0348HIGHCVSS 8.0EG 8.0

2018-02-21

Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: …

CVE-2016-10522HIGHCVSS 8.8EG 8.8

2018-07-05

rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpo…

CVE-2016-10529HIGHCVSS 8.8EG 8.8

2018-05-31

Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this mean…

CVE-2016-10738HIGHCVSS 8.8EG 8.8

2019-01-16

Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

CVE-2016-10756HIGHCVSS 8.8EG 8.8

2019-05-24

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.

CVE-2016-10757HIGHCVSS 8.8EG 8.8

2019-05-24

In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.

CVE-2016-10766HIGHCVSS 8.8EG 8.8

2019-07-29

edx-platform before 2016-06-06 allows CSRF.

CVE-2016-10861MEDIUMCVSS 6.5EG 6.5

2019-08-07

Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.

CVE-2016-10862HIGHCVSS 8.8EG 8.8

2019-08-08

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.

CVE-2016-10863HIGHCVSS 8.8EG 8.8

2019-08-08

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.

CVE-2016-10865MEDIUMCVSS 6.1EG 6.1

2019-08-09

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.

CVE-2016-10874HIGHCVSS 8.8EG 8.8

2019-08-12

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

CVE-2016-10876HIGHCVSS 8.8EG 8.8

2019-08-12

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

CVE-2016-10882HIGHCVSS 8.8EG 8.8

CVE-2016-10883MEDIUMCVSS 6.5EG 6.5

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

CVE-2016-10884HIGHCVSS 8.8EG 8.8

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.

CVE-2016-10885HIGHCVSS 8.8EG 8.8

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.

CVE-2016-10902HIGHCVSS 8.8EG 8.8

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

2019-08-21

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

CVE-2016-10903HIGHCVSS 8.8EG 8.8

2019-08-21

The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.

CVE-2016-10914HIGHCVSS 8.8EG 8.8

2019-08-20

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.

CVE-2016-10915HIGHCVSS 8.8EG 8.8

2019-08-20

The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.

CVE-2016-10918HIGHCVSS 8.8EG 8.8

2019-08-22

The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.

CVE-2016-10938MEDIUMCVSS 6.5EG 6.5

CVE-2016-10944HIGHCVSS 8.8EG 8.8

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.

CVE-2016-10945HIGHCVSS 8.8EG 8.8

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.

CVE-2016-10946HIGHCVSS 8.8EG 8.8

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.

CVE-2016-10962MEDIUMCVSS 6.5EG 6.5

The wp-d3 plugin before 2.4.1 for WordPress has CSRF.

2019-09-16

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.

CVE-2016-10974HIGHCVSS 8.8EG 8.8

CVE-2016-10978HIGHCVSS 8.8EG 8.8

The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.

CVE-2016-10982HIGHCVSS 8.8EG 8.8

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.

CVE-2016-10989HIGHCVSS 8.8EG 8.8

The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.