Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.

CVE-2023-42323HIGHCVSS 8.8EG 8.8

2023-10-30

Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.

CVE-2023-42435MEDIUMCVSS 5.5EG 5.5

2023-10-19

The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user.

CVE-2023-4246MEDIUMCVSS 4.3EG 4.3

2024-01-11

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it po…

CVE-2023-4247MEDIUMCVSS 5.4EG 5.4

2024-01-11

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for u…

CVE-2023-4248MEDIUMCVSS 5.4EG 5.4

2024-01-11

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This …

CVE-2023-4251MEDIUMCVSS 4.3EG 4.3

2023-10-31

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

CVE-2023-4276HIGHCVSS 8.8EG 8.8

2023-08-10

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauth…

CVE-2023-4277HIGHCVSS 8.8EG 8.8

2023-08-10

The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthen…

CVE-2023-4301MEDIUMCVSS 4.2EG 4.2

2023-08-21

A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cr…

CVE-2023-4307MEDIUMCVSS 4.3EG 4.3

2023-09-11

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack

CVE-2023-43118HIGHCVSS 8.8EG 8.8

2023-10-16

Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /js…

CVE-2023-43147HIGHCVSS 8.8EG 8.8

2023-10-12

PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.

CVE-2023-43148HIGHCVSS 8.1EG 8.1

2023-10-12

SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.

CVE-2023-43149HIGHCVSS 8.8EG 8.8

2023-10-12

SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.

CVE-2023-4318MEDIUMCVSS 4.3EG 4.3

2023-09-11

The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack

CVE-2023-43275HIGHCVSS 8.8EG 8.8

2023-11-16

Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.

CVE-2023-43278HIGHCVSS 8.8EG 8.8

2023-09-25

A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.

CVE-2023-43295LOWCVSS 3.5EG 3.5

2023-10-31

Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.

CVE-2023-43500HIGHCVSS 8.8EG 8.8

2023-09-20

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

CVE-2023-43502MEDIUMCVSS 4.3EG 4.3

2023-09-20

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

CVE-2023-43649MEDIUMCVSS 4.7EG 4.7

2023-10-30

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.

CVE-2023-44146MEDIUMCVSS 4.3EG 4.3

2023-10-06

Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions.

CVE-2023-44160MEDIUMCVSS 6.5EG 3.1

2023-09-27

Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

CVE-2023-44161MEDIUMCVSS 6.5EG 3.1

2023-09-27

Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

CVE-2023-44231MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.

CVE-2023-44232MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.

CVE-2023-44233MEDIUMCVSS 5.4EG 5.4

2023-10-06

Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.

CVE-2023-44236MEDIUMCVSS 5.4EG 5.4

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions.

CVE-2023-44237MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.

CVE-2023-44238MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions.

CVE-2023-44240MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions.

CVE-2023-44241MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Keap Keap Landing Pages plugin <= 1.4.2 versions.

CVE-2023-44243MEDIUMCVSS 4.3EG 4.3

2023-10-06

Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.

CVE-2023-44246MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.

CVE-2023-44257MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Hometory Mang Board WP plugin <= 1.7.6 versions.

CVE-2023-44259MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.

CVE-2023-44260MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions.

CVE-2023-44261MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions.

CVE-2023-44385HIGHCVSS 8.6EG 8.6

2023-10-19

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in…

CVE-2023-44470MEDIUMCVSS 5.4EG 5.4

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions.

CVE-2023-44471MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions.

CVE-2023-44473MEDIUMCVSS 5.4EG 5.4

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions.

CVE-2023-44475MEDIUMCVSS 5.4EG 5.4

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions.

CVE-2023-44476MEDIUMCVSS 4.3EG 4.3

2023-10-10

Cross-Site Request Forgery (CSRF) vulnerability in Andres Felipe Perea V. CopyRightPro plugin <= 2.1 versions.

CVE-2023-44478HIGHCVSS 7.1EG 7.1

2024-05-17

Cross-Site Request Forgery (CSRF) vulnerability in WP Hive Events Rich Snippets for Google allows Exploitation of Trusted Credentials.This issue affects Events Rich Snippets for Google: from n/a through 1.8.

CVE-2023-4454MEDIUMCVSS 5.7EG 5.7

2023-08-21

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVE-2023-4455MEDIUMCVSS 6.5EG 6.5

2023-08-21

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVE-2023-44811HIGHCVSS 8.8EG 8.8

2023-10-09

Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.

CVE-2023-44993MEDIUMCVSS 4.3EG 4.3

2023-10-09

Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions.

CWE-352— Cross-Site Request Forgery (CSRF)

CVEs classified under CWE-352page 94 of 175

Map vulnerabilities like CWE-352 to your infrastructure