The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arb…

CVE-2021-34661MEDIUMCVSS 6.1EG 6.1

2021-08-09

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, i…

CVE-2021-34743MEDIUMCVSS 4.3EG 4.3

2021-10-21

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express c…

CVE-2021-34773MEDIUMCVSS 6.5EG 6.5

2021-11-04

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM &…

CVE-2021-35242HIGHCVSS 8.3EG 8.3

2021-12-06

Serv-U server responds with valid CSRFToken when the request contains only Session.

CVE-2021-35343MEDIUMCVSS 4.3EG 4.3

2021-08-03

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an atta…

CVE-2021-35491HIGHCVSS 8.1EG 8.1

2021-10-05

A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not imple…

CVE-2021-36443HIGHCVSS 8.8EG 8.8

2023-02-03

Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.

CVE-2021-36444HIGHCVSS 8.8EG 8.8

2023-02-03

Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.

CVE-2021-36542MEDIUMCVSS 4.3EG 4.3

2021-08-03

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit…

CVE-2021-36543MEDIUMCVSS 4.3EG 4.3

2021-08-03

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to …

CVE-2021-36569HIGHCVSS 8.8EG 8.8

2023-02-03

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.

CVE-2021-36570HIGHCVSS 8.8EG 8.8

2023-02-03

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.

CVE-2021-3683MEDIUMCVSS 6.5EG 5.4

2021-11-13

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-36850MEDIUMCVSS 5.4EG 5.4

2021-10-04

Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media…

CVE-2021-36852MEDIUMCVSS 4.3EG 8.0

2022-08-22

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.

CVE-2021-36854MEDIUMCVSS 5.4EG 8.8

2022-09-30

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

CVE-2021-36855MEDIUMCVSS 6.1EG 6.1

2022-09-30

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

CVE-2021-36861MEDIUMCVSS 5.4EG 4.3

2022-08-05

Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.

CVE-2021-36876MEDIUMCVSS 5.4EG 5.4

2021-09-27

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.

CVE-2021-36877MEDIUMCVSS 4.3EG 4.3

2021-09-27

Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.

CVE-2021-36878MEDIUMCVSS 4.3EG 4.3

2021-09-27

Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings.

CVE-2021-36886MEDIUMCVSS 6.5EG 8.8

2021-12-22

Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).

CVE-2021-36887MEDIUMCVSS 6.1EG 6.1

2021-12-20

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarte…

CVE-2021-36890MEDIUMCVSS 4.3EG 4.3

2022-06-02

Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress.

CVE-2021-36891MEDIUMCVSS 5.4EG 4.3

2022-06-15

Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings.

CVE-2021-36908HIGHCVSS 8.8EG 8.8

2021-11-18

Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.

CVE-2021-36914MEDIUMCVSS 6.1EG 6.1

2022-04-12

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.

CVE-2021-36915MEDIUMCVSS 4.2EG 4.3

2022-10-11

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.

CVE-2021-37198HIGHCVSS 8.8EG 8.8

2022-01-11

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used)…

CVE-2021-37201HIGHCVSS 8.8EG 8.8

2021-09-14

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This could allow an attacker to manipulate the SINEC NMS configu…

CVE-2021-37234MEDIUMCVSS 6.5EG 6.5

2023-02-03

Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.

CVE-2021-3728MEDIUMCVSS 6.5EG 6.5

2021-08-23

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3729MEDIUMCVSS 4.3EG 4.3

2021-08-23

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3730MEDIUMCVSS 6.5EG 6.5

2021-08-23

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3734HIGHCVSS 8.8EG 6.5

2021-08-26

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames

CVE-2021-37366HIGHCVSS 8.8EG 8.8

2021-08-10

CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standar…

CVE-2021-37381HIGHCVSS 8.8EG 8.8

2021-08-06

Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImage…

CVE-2021-37725HIGHCVSS 8.1EG 8.1

2021-09-07

A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Ar…

CVE-2021-3775MEDIUMCVSS 5.4EG 4.3

2021-11-13

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3776MEDIUMCVSS 5.4EG 5.4

2021-11-13

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3819HIGHCVSS 8.8EG 8.8

2021-09-27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-38342HIGHCVSS 8.1EG 8.1

2021-08-30

The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changi…

CVE-2021-38480CRITICALCVSS 9.6EG 9.6

2021-10-19

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands are submitted from a user the web application trusts. This may allow an attacker to remotely perfor…

CVE-2021-3858HIGHCVSS 8.8EG 8.8

2021-10-19

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-38705HIGHCVSS 8.8EG 8.8

2021-09-07

ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the tar…

CVE-2021-38721MEDIUMCVSS 6.5EG 6.5

2021-09-09

FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability

CVE-2021-38868MEDIUMCVSS 6.5EG 6.5

2022-07-18

IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trus…

CVE-2021-38886HIGHCVSS 8.8EG 8.8

2022-04-22

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.

CVE-2021-3900MEDIUMCVSS 6.5EG 6.5

2021-10-27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 60 of 174

Map vulnerabilities like CWE-352 to your infrastructure