Total
9398 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-32175 | 1 Adguard | 1 Adguardhome | 2025-05-20 | 5.4 Medium |
| In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules. | ||||
| CVE-2024-4757 | 1 Wp-master | 1 Logo Manager For Enamad | 2025-05-19 | 8.1 High |
| The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2024-4534 | 1 Krzysztof-furtak | 1 Kkprogressbar2 | 2025-05-19 | 6.1 Medium |
| The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2024-4535 | 1 Krzysztof-furtak | 1 Kkprogressbar2 | 2025-05-19 | 8.8 High |
| The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks | ||||
| CVE-2024-5935 | 1 Pribai | 1 Privategpt | 2025-05-19 | 5.4 Medium |
| A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users. | ||||
| CVE-2024-4758 | 1 Realwebcare | 1 Muslim Prayer Time Bd | 2025-05-19 | 7.6 High |
| The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack | ||||
| CVE-2024-5287 | 1 Tipsandtricks-hq | 1 Wp Affiliate Platform | 2025-05-19 | 7.1 High |
| The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack | ||||
| CVE-2024-5284 | 1 Tipsandtricks-hq | 1 Wp Affiliate Platform | 2025-05-19 | 6.8 Medium |
| The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2024-5280 | 1 Tipsandtricks-hq | 1 Wp Affiliate Platform | 2025-05-19 | 4.7 Medium |
| The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack | ||||
| CVE-2024-3642 | 1 Mndpsingh287 | 1 Newsletter Popup | 2025-05-19 | 6.9 Medium |
| The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack | ||||
| CVE-2023-6385 | 1 Wordpress Ping Optimizer Project | 1 Wordpress Ping Optimizer | 2025-05-19 | 4.3 Medium |
| The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs. | ||||
| CVE-2024-11842 | 1 Digireturn | 1 Shipping By Weight For Woocommerce | 2025-05-17 | 4.3 Medium |
| The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-10480 | 1 Wp3dprinting | 1 3dprint Lite | 2025-05-17 | 4.3 Medium |
| The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. | ||||
| CVE-2024-45983 | 1 Kishan0725 | 1 Hospital Management System | 2025-05-16 | 6.3 Medium |
| A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent. | ||||
| CVE-2022-34020 | 1 Resiot | 1 Iot Platform And Lorawan Network Server | 2025-05-16 | 8.8 High |
| Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin users to the platform or other unspecified impacts. | ||||
| CVE-2023-7269 | 1 Artplacer | 1 Artplacer Widget | 2025-05-16 | 7.5 High |
| The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2024-25419 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php. | ||||
| CVE-2024-25418 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php. | ||||
| CVE-2024-24468 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. | ||||
| CVE-2024-24819 | 1 Icinga | 1 Icingaweb2-module-incubator | 2025-05-15 | 5.3 Medium |
| icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||