Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Se…

CVE-2021-41274CRITICALCVSS 9.3EG 9.3

2021-11-17

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications …

CVE-2021-41275CRITICALCVSS 9.3EG 9.3

2021-11-17

spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise…

CVE-2021-41295HIGHCVSS 8.8EG 8.8

2021-09-30

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations …

CVE-2021-4130HIGHCVSS 8.8EG 8.8

2021-12-18

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4131HIGHCVSS 8.8EG 8.8

2021-12-18

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-41372HIGHCVSS 7.6EG 7.6

2021-11-10

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Co…

CVE-2021-41426HIGHCVSS 8.8EG 8.8

2021-11-10

Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.

CVE-2021-41597HIGHCVSS 8.8EG 8.8

2022-01-12

SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.

CVE-2021-4162MEDIUMCVSS 4.3EG 4.3

2021-12-25

archivy is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4164HIGHCVSS 8.8EG 8.8

2022-01-17

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4168HIGHCVSS 8.8EG 8.8

2021-12-26

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-41764HIGHCVSS 8.8EG 8.8

2021-09-29

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a …

CVE-2021-41916HIGHCVSS 8.8EG 8.8

2021-10-08

A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an au…

CVE-2021-42097HIGHCVSS 8.0EG 8.0

2021-10-21

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a C…

CVE-2021-42228HIGHCVSS 8.8EG 8.8

2021-10-14

A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.

CVE-2021-42358HIGHCVSS 8.8EG 8.8

2021-11-29

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary…

CVE-2021-42364HIGHCVSS 8.8EG 8.8

2021-11-29

The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in ver…

CVE-2021-4268MEDIUMCVSS 4.3EG 8.8

2022-12-21

A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to…

CVE-2021-4275MEDIUMCVSS 4.3EG 8.8

2022-12-21

A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name o…

CVE-2021-43137HIGHCVSS 8.8EG 8.8

2021-12-01

Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.

CVE-2021-43156MEDIUMCVSS 6.5EG 6.5

2021-12-22

In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.

CVE-2021-43158MEDIUMCVSS 4.3EG 4.3

2021-12-22

In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.

CVE-2021-4333MEDIUMCVSS 6.5EG 6.5

2023-03-07

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenti…

CVE-2021-43353HIGHCVSS 8.8EG 8.8

2022-01-18

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbi…

CVE-2021-4349HIGHCVSS 8.8EG 8.8

2023-06-07

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged re…

CVE-2021-43559HIGHCVSS 8.8EG 8.8

2021-11-22

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

CVE-2021-4373HIGHCVSS 8.8EG 8.8

2023-06-07

The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a…

CVE-2021-43737MEDIUMCVSS 6.5EG 6.5

2022-03-23

An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password.

CVE-2021-43738HIGHCVSS 8.8EG 8.8

2022-03-23

An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account.

CVE-2021-43777MEDIUMCVSS 6.8EG 6.8

2021-11-24

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `state` parameter to pass the next URL to redirect the user to after login. The `…

CVE-2021-4384MEDIUMCVSS 4.3EG 4.3

2023-07-01

The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the load_images_thumbnail() and…

CVE-2021-43846MEDIUMCVSS 5.3EG 5.3

2021-12-20

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to a…

CVE-2021-4385MEDIUMCVSS 4.3EG 8.8

2023-07-01

The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_groups() function. This makes it possible …

CVE-2021-4386MEDIUMCVSS 4.3EG 8.8

2023-07-01

The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unau…

CVE-2021-4387MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect nonce validation on the opalestate_set_feature_property() and opalestate_remove_…

CVE-2021-4389MEDIUMCVSS 4.3EG 4.3

2023-07-01

The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unaut…

CVE-2021-4390MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This m…

CVE-2021-4391MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the mwb_wgm_save_post() function. Thi…

CVE-2021-4392MEDIUMCVSS 4.3EG 4.3

2023-07-01

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_produc…

CVE-2021-4393MEDIUMCVSS 4.3EG 4.3

2023-07-01

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. This is due to missing or incorrect nonce validation on the save() function. This…

CVE-2021-43937HIGHCVSS 7.6EG 8.8

2022-04-29

Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVE-2021-4394MEDIUMCVSS 4.3EG 8.8

2023-07-01

The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for una…

CVE-2021-43941MEDIUMCVSS 6.5EG 6.5

2022-02-15

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in…

CVE-2021-4395MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the get_items() and extra_tablena…

CVE-2021-43952MEDIUMCVSS 4.3EG 4.3

2022-02-15

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jsp…

CVE-2021-43953MEDIUMCVSS 4.3EG 4.3

2022-02-15

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewIn…

CVE-2021-4396MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the save_rc_post_meta() function. This makes it possible for unauthe…

CVE-2021-4397MEDIUMCVSS 4.3EG 4.3

2023-07-01

The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possi…

CVE-2021-4398MEDIUMCVSS 4.3EG 8.8

2023-07-01

The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing or incorrect nonce validation on the at_save_aturl_meta() function. This makes …

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 62 of 175

Map vulnerabilities like CWE-352 to your infrastructure