Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.

CVE-2022-43469MEDIUMCVSS 5.4EG 8.8

2023-02-14

Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.

CVE-2022-43470HIGHCVSS 7.3EG 7.3

2022-12-05

Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and e…

CVE-2022-43481MEDIUMCVSS 5.4EG 4.3

2022-11-08

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

CVE-2022-43488MEDIUMCVSS 5.4EG 4.3

2022-11-09

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.

CVE-2022-4349MEDIUMCVSS 4.3EG 6.8

2022-12-08

A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exp…

CVE-2022-43490MEDIUMCVSS 5.4EG 5.4

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.

CVE-2022-43491MEDIUMCVSS 5.4EG 4.3

2022-11-08

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

CVE-2022-4363MEDIUMCVSS 6.5EG 6.5

2025-05-16

The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via…

CVE-2022-4368MEDIUMCVSS 6.1EG 6.1

2023-01-09

The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.

CVE-2022-43693HIGHCVSS 8.8EG 8.8

2022-11-14

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

CVE-2022-43710HIGHCVSS 8.8EG 8.8

2023-07-26

Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields.

CVE-2022-43719HIGHCVSS 8.8EG 8.8

2023-01-16

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2022-4386MEDIUMCVSS 4.3EG 4.3

2023-02-21

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack

CVE-2022-4397MEDIUMCVSS 4.3EG 6.5

2022-12-10

A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/Comment.php of the component Comment Handler. The manipulation leads to cross-sit…

CVE-2022-43980MEDIUMCVSS 5.2EG 5.4

2023-01-27

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin…

CVE-2022-4426MEDIUMCVSS 4.3EG 4.3

2023-01-09

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in ad…

CVE-2022-44387HIGHCVSS 8.8EG 8.8

2022-11-14

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.

CVE-2022-44389MEDIUMCVSS 6.5EG 6.5

2022-11-14

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to arbitrarily change Administrator account information.

CVE-2022-4443MEDIUMCVSS 6.5EG 6.5

2023-01-23

The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.

CVE-2022-44585MEDIUMCVSS 5.4EG 8.8

2023-02-02

Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.

CVE-2022-44627MEDIUMCVSS 5.4EG 5.4

2022-11-03

Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.

CVE-2022-44737MEDIUMCVSS 6.5EG 8.8

2022-11-22

Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.

CVE-2022-44739MEDIUMCVSS 5.3EG 5.3

2023-05-22

Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.

CVE-2022-44740MEDIUMCVSS 5.4EG 8.8

2022-11-18

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

CVE-2022-44741MEDIUMCVSS 6.1EG 8.8

2022-11-08

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

CVE-2022-44849HIGHCVSS 8.8EG 8.8

2022-12-07

A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.

CVE-2022-44937MEDIUMCVSS 6.5EG 6.5

2022-11-28

Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.

CVE-2022-45067MEDIUMCVSS 4.3EG 8.8

2023-02-02

Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions.

CVE-2022-45068MEDIUMCVSS 4.3EG 8.8

2023-03-01

Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.

CVE-2022-45071MEDIUMCVSS 5.4EG 8.8

2022-11-17

Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

CVE-2022-45072MEDIUMCVSS 4.3EG 4.3

2022-11-17

Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

CVE-2022-45073MEDIUMCVSS 5.4EG 8.8

2022-11-18

Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

CVE-2022-45074MEDIUMCVSS 4.3EG 4.3

2023-04-23

Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.

CVE-2022-45076MEDIUMCVSS 4.3EG 4.3

2023-05-22

Cross-Site Request Forgery (CSRF) vulnerability in WebMat Flexible Elementor Panel plugin <= 2.3.8 versions.

CVE-2022-45079MEDIUMCVSS 4.7EG 4.3

2023-05-22

Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.

CVE-2022-45080MEDIUMCVSS 5.4EG 5.4

2023-04-23

Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.

CVE-2022-45127HIGHCVSS 8.1EG 8.1

2023-01-18

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitra…

CVE-2022-45130MEDIUMCVSS 6.5EG 6.5

2022-11-10

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention …

CVE-2022-45149MEDIUMCVSS 5.4EG 5.4

2022-11-23

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just r…

CVE-2022-45228LOWCVSS 3.5EG 3.5

2022-12-12

Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page.

CVE-2022-45364MEDIUMCVSS 5.4EG 5.4

2023-05-24

Cross-Site Request Forgery (CSRF) vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.6.5 versions.

CVE-2022-45367MEDIUMCVSS 4.3EG 4.3

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.

CVE-2022-45371MEDIUMCVSS 5.4EG 5.4

2023-05-25

Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions.

CVE-2022-45372MEDIUMCVSS 4.3EG 4.3

2023-05-29

Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.

CVE-2022-45376MEDIUMCVSS 4.3EG 4.3

2023-05-22

Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions.

CVE-2022-45393LOWCVSS 3.5EG 5.7

2022-11-15

A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.

CVE-2022-45398MEDIUMCVSS 4.3EG 4.3

2022-11-15

A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.

CVE-2022-45475MEDIUMCVSS 6.5EG 8.8

2022-11-25

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.

CVE-2022-45476CRITICALCVSS 9.8EG 8.8

2022-11-25

Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 76 of 175

Map vulnerabilities like CWE-352 to your infrastructure