Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password vi…

CVE-2018-17045HIGHCVSS 8.8EG 8.8

2018-09-14

An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.

CVE-2018-17069MEDIUMCVSS 6.5EG 6.5

2018-09-15

An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay.

CVE-2018-17070MEDIUMCVSS 6.5EG 6.5

2018-09-15

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay.

CVE-2018-17081MEDIUMCVSS 4.3EG 4.3

2018-09-26

e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page.

CVE-2018-17102HIGHCVSS 8.8EG 8.8

2018-09-16

An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.

CVE-2018-17103HIGHCVSS 8.8EG 8.8

2018-09-16

An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter

CVE-2018-17104HIGHCVSS 8.8EG 8.8

2018-09-16

An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.

CVE-2018-1712HIGHCVSS 8.6EG 9.9

2018-08-16

IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted …

CVE-2018-17168MEDIUMCVSS 6.5EG 6.5

2019-04-18

PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disabl…

CVE-2018-17366HIGHCVSS 8.8EG 8.8

2018-09-23

An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.

CVE-2018-17387HIGHCVSS 8.8EG 8.8

2019-06-19

CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.

CVE-2018-17389HIGHCVSS 8.8EG 8.8

2019-06-19

CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account.

CVE-2018-17429HIGHCVSS 8.8EG 8.8

2019-03-07

/console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.

CVE-2018-17451HIGHCVSS 8.8EG 8.8

2023-04-15

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

CVE-2018-17584HIGHCVSS 8.8EG 8.8

2019-04-15

The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.

CVE-2018-17789MEDIUMCVSS 6.5EG 6.5

2019-09-20

Prospecta Master Data Online (MDO) allows CSRF.

CVE-2018-17792HIGHCVSS 8.8EG 8.8

2019-07-19

MDaemon Webmail (formerly WorldClient) has CSRF.

CVE-2018-17826HIGHCVSS 8.8EG 8.8

2018-10-01

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default …

CVE-2018-17858HIGHCVSS 8.8EG 8.8

2018-10-09

An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.

CVE-2018-17869HIGHCVSS 8.8EG 8.8

2018-10-01

DASAN H660GW devices do not implement any CSRF protection mechanism.

CVE-2018-1790MEDIUMCVSS 4.3EG 4.3

2019-05-10

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the websit…

CVE-2018-17986HIGHCVSS 8.8EG 8.8

2018-10-05

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.

CVE-2018-17996MEDIUMCVSS 6.5EG 6.5

2019-03-21

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.

CVE-2018-18191HIGHCVSS 8.8EG 8.8

2018-10-09

Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.

CVE-2018-18201HIGHCVSS 8.8EG 8.8

2018-10-09

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.

CVE-2018-18215HIGHCVSS 8.8EG 8.8

2018-10-11

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account.

CVE-2018-18246MEDIUMCVSS 6.5EG 6.5

2018-12-17

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.

CVE-2018-18316HIGHCVSS 8.8EG 8.8

2018-10-15

emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.

CVE-2018-18317HIGHCVSS 8.8EG 8.8

2018-10-15

DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.

CVE-2018-18420HIGHCVSS 8.8EG 8.8

2018-10-19

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.

CVE-2018-18422HIGHCVSS 8.8EG 8.8

2018-10-17

UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.

CVE-2018-18432HIGHCVSS 8.8EG 8.8

2018-10-17

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request.

CVE-2018-18436HIGHCVSS 8.8EG 8.8

2018-10-17

JTBC(PHP) 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI.

CVE-2018-18449HIGHCVSS 8.8EG 8.8

2019-03-07

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.

CVE-2018-1858HIGHCVSS 8.8EG 8.8

2019-06-25

IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256.

CVE-2018-18696HIGHCVSS 8.8EG 8.8

2018-12-28

main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature…

CVE-2018-18711HIGHCVSS 8.8EG 8.8

2018-10-29

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.

CVE-2018-18712HIGHCVSS 8.8EG 8.8

2018-10-29

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.

CVE-2018-18734HIGHCVSS 8.8EG 8.8

2018-10-29

A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.

CVE-2018-18735HIGHCVSS 8.8EG 8.8

2018-10-29

A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.

CVE-2018-18742HIGHCVSS 8.8EG 8.8

2018-10-29

A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.

CVE-2018-18760MEDIUMCVSS 6.5EG 6.5

2018-11-16

RhinOS 3.0 build 1190 allows CSRF.

CVE-2018-18772HIGHCVSS 8.8EG 8.8

2018-11-20

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

CVE-2018-18773HIGHCVSS 8.8EG 8.8

2018-11-20

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.

CVE-2018-18794HIGHCVSS 8.8EG 8.8

2018-11-16

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.

CVE-2018-18797HIGHCVSS 8.8EG 8.8

2018-11-16

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.

CVE-2018-18799HIGHCVSS 8.8EG 8.8

2018-11-16

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.

CVE-2018-18802HIGHCVSS 8.8EG 8.8

2019-06-18

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.

CVE-2018-18842HIGHCVSS 8.8EG 8.8

2018-10-30

CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 30 of 173

Map vulnerabilities like CWE-352 to your infrastructure