A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets f…

CVE-2022-3098MEDIUMCVSS 4.3EG 4.3

2022-09-26

The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVE-2022-31000LOWCVSS 2.3EG 2.3

2022-06-01

solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of a…

CVE-2022-3119HIGHCVSS 7.5EG 7.5

2022-09-26

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls,…

CVE-2022-3121MEDIUMCVSS 4.3EG 8.8

2022-09-05

A vulnerability was found in SourceCodester Online Employee Leave Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addemployee.php. The manipulation l…

CVE-2022-3126MEDIUMCVSS 4.3EG 4.3

2022-10-17

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf

CVE-2022-31294MEDIUMCVSS 6.5EG 6.5

2022-06-16

An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts.

CVE-2022-3149MEDIUMCVSS 6.1EG 6.1

2022-10-17

The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the l…

CVE-2022-3151MEDIUMCVSS 4.3EG 4.3

2022-10-17

The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack.

CVE-2022-3154HIGHCVSS 7.1EG 7.1

2022-10-10

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJA…

CVE-2022-31773HIGHCVSS 8.8EG 8.8

2022-08-26

IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 2283…

CVE-2022-31886MEDIUMCVSS 6.5EG 6.5

2022-06-28

Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.

CVE-2022-3208MEDIUMCVSS 6.5EG 6.5

2022-10-10

The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.

CVE-2022-32175MEDIUMCVSS 5.4EG 5.4

2022-10-11

In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in del…

CVE-2022-3221HIGHCVSS 8.8EG 8.8

2022-09-15

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.

CVE-2022-32289MEDIUMCVSS 5.4EG 4.3

2022-07-21

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

CVE-2022-3232MEDIUMCVSS 4.3EG 4.3

2022-09-17

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.

CVE-2022-32320HIGHCVSS 8.8EG 8.8

2022-07-17

A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a settings/preferences file.

CVE-2022-3233MEDIUMCVSS 4.3EG 4.3

2022-09-21

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.

CVE-2022-3240HIGHCVSS 8.8EG 8.8

2022-11-15

The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes i…

CVE-2022-32516HIGHCVSS 7.5EG 6.5

2023-01-30

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product suffers from POST-Based Cross-Site Request Forgery (CSRF). Affected Products: Co…

CVE-2022-32533CRITICALCVSS 9.8EG 9.8

2022-07-06

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apa…

CVE-2022-32555HIGHCVSS 8.8EG 8.8

2022-09-13

Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.

CVE-2022-32587MEDIUMCVSS 5.4EG 4.3

2022-11-08

Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.

CVE-2022-3267MEDIUMCVSS 4.3EG 4.3

2022-09-22

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.

CVE-2022-3274LOWCVSS 3.5EG 3.5

2022-09-22

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.

CVE-2022-33121HIGHCVSS 8.1EG 8.1

2022-06-24

A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.

CVE-2022-33177MEDIUMCVSS 5.4EG 4.3

2022-09-06

Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.

CVE-2022-33201MEDIUMCVSS 6.3EG 8.8

2022-08-05

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

CVE-2022-3336MEDIUMCVSS 4.3EG 4.3

2022-11-21

The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack

CVE-2022-3372HIGHCVSS 8.8EG 8.8

2023-06-21

There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could all…

CVE-2022-33974MEDIUMCVSS 5.4EG 5.4

2023-05-29

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.

CVE-2022-34020HIGHCVSS 8.8EG 8.8

2022-10-13

Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin users to the platform or other unspecified impacts.

CVE-2022-34134HIGHCVSS 8.8EG 8.8

2022-06-28

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.

CVE-2022-34158HIGHCVSS 8.8EG 8.8

2022-08-04

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established…

CVE-2022-34161HIGHCVSS 8.8EG 8.8

2022-08-01

IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 229331.

CVE-2022-3419MEDIUMCVSS 6.5EG 6.5

2022-10-31

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator

CVE-2022-34200HIGHCVSS 8.8EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2022-34203HIGHCVSS 8.8EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server.

CVE-2022-34205MEDIUMCVSS 6.5EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.

CVE-2022-34207MEDIUMCVSS 6.5EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2022-34209MEDIUMCVSS 6.5EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2022-34211MEDIUMCVSS 6.5EG 4.3

2022-06-23

A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.

CVE-2022-3427HIGHCVSS 8.8EG 6.5

2022-12-15

The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible f…

CVE-2022-34347MEDIUMCVSS 4.2EG 8.8

2022-08-22

Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

CVE-2022-34367MEDIUMCVSS 5.4EG 8.8

2022-07-21

Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability. A(n) remote unauthenticated attacker could potentially exploit this vulnerability, leading to processing o…

CVE-2022-34448HIGHCVSS 8.8EG 8.8

2023-02-11

PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability. An unauthenticated non-privileged user could potentially exploit the issue and perform any privileged state-changing …

CVE-2022-3451MEDIUMCVSS 4.3EG 4.3

2022-11-07

The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to upda…

CVE-2022-34654MEDIUMCVSS 4.3EG 8.8

2022-11-28

Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.

CVE-2022-34780MEDIUMCVSS 6.5EG 6.5

2022-06-30

A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another …

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 71 of 175

Map vulnerabilities like CWE-352 to your infrastructure