FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability

CVE-2021-38868MEDIUMCVSS 6.5EG 6.5

2022-07-18

IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trus…

CVE-2021-38886HIGHCVSS 8.8EG 8.8

2022-04-22

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.

CVE-2021-3900MEDIUMCVSS 6.5EG 6.5

2021-10-27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3901HIGHCVSS 8.8EG 3.5

2021-10-27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-39044HIGHCVSS 8.8EG 8.8

2022-02-02

IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 214210.

CVE-2021-39124MEDIUMCVSS 4.3EG 4.3

2021-09-14

The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a …

CVE-2021-39126MEDIUMCVSS 6.5EG 8.8

2021-10-21

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers …

CVE-2021-39133HIGHCVSS 7.2EG 7.2

2021-08-30

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attac…

CVE-2021-39197MEDIUMCVSS 6.3EG 6.3

2021-09-07

better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSR…

CVE-2021-39198MEDIUMCVSS 4.2EG 4.2

2021-11-19

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. Th…

CVE-2021-39209HIGHCVSS 8.8EG 8.8

2021-09-15

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many…

CVE-2021-3921MEDIUMCVSS 4.3EG 4.3

2021-11-13

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-39243MEDIUMCVSS 6.5EG 6.5

2021-08-23

Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.…

CVE-2021-3931MEDIUMCVSS 4.3EG 4.3

2021-11-13

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3932MEDIUMCVSS 4.3EG 4.3

2021-11-13

twill is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-39353HIGHCVSS 8.8EG 8.8

2021-11-19

The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inj…

CVE-2021-39394MEDIUMCVSS 6.5EG 6.5

2022-08-26

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and modify user information.

CVE-2021-3944MEDIUMCVSS 6.8EG 6.8

2021-12-02

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3957MEDIUMCVSS 4.3EG 4.3

2021-11-19

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3963MEDIUMCVSS 4.3EG 4.3

2021-11-19

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-3976MEDIUMCVSS 6.5EG 6.5

2021-11-19

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-39864MEDIUMCVSS 6.5EG 6.5

2021-10-15

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized a…

CVE-2021-3993MEDIUMCVSS 6.5EG 6.5

2021-12-01

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4005MEDIUMCVSS 4.3EG 4.3

2021-12-04

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-40108HIGHCVSS 8.8EG 8.8

2021-09-27

An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint.

CVE-2021-4015MEDIUMCVSS 4.3EG 4.3

2021-12-01

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4017HIGHCVSS 8.8EG 8.8

2021-12-01

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-40172HIGHCVSS 8.8EG 8.8

2021-08-29

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.

CVE-2021-40173HIGHCVSS 8.8EG 8.8

2021-08-29

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.

CVE-2021-40174HIGHCVSS 8.8EG 8.8

2021-08-29

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.

CVE-2021-4030HIGHCVSS 8.0EG 8.0

2022-02-24

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious script…

CVE-2021-4033MEDIUMCVSS 6.5EG 6.5

2021-12-09

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-40335MEDIUMCVSS 5.0EG 8.8

2022-07-25

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Req…

CVE-2021-40336MEDIUMCVSS 5.0EG 8.8

2022-07-25

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into …

CVE-2021-4049MEDIUMCVSS 6.5EG 6.5

2021-12-07

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-40518MEDIUMCVSS 6.5EG 6.5

2021-11-10

Airangel HSMX Gateway devices through 5.2.04 allow CSRF.

CVE-2021-40662HIGHCVSS 8.8EG 8.8

2022-03-21

A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.

CVE-2021-4082MEDIUMCVSS 4.3EG 4.3

2021-12-10

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4092MEDIUMCVSS 4.3EG 4.3

2021-12-11

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4096HIGHCVSS 8.8EG 8.8

2022-04-19

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a serve…

CVE-2021-40965HIGHCVSS 8.8EG 8.8

2021-09-15

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an…

CVE-2021-41074MEDIUMCVSS 5.4EG 5.4

2026-01-12

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.

CVE-2021-41083HIGHCVSS 8.0EG 8.0

2021-09-20

Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad …

CVE-2021-41113HIGHCVSS 8.8EG 8.8

2021-10-05

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable …

CVE-2021-41176MEDIUMCVSS 4.3EG 4.3

2021-10-25

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request …

CVE-2021-4123MEDIUMCVSS 6.5EG 6.5

2021-12-16

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-41245MEDIUMCVSS 6.5EG 6.5

2022-04-05

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaroun…

CVE-2021-41260HIGHCVSS 8.2EG 8.2

2021-12-16

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon …

CVE-2021-41273MEDIUMCVSS 4.3EG 4.3

2021-11-17

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Se…

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 61 of 174

Map vulnerabilities like CWE-352 to your infrastructure