Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-27490

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-09 Mar, 2023 | 20:37
Updated At-25 Feb, 2025 | 14:59
Rejected At-
Credits

Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:09 Mar, 2023 | 20:37
Updated At:25 Feb, 2025 | 14:59
Rejected At:
â–¼CVE Numbering Authority (CNA)
Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.

Affected Products
Vendor
nextauthjs
Product
next-auth
Versions
Affected
  • < 4.20.1
Problem Types
TypeCWE IDDescription
CWECWE-384CWE-384: Session Fixation
CWECWE-352CWE-352: Cross-Site Request Forgery (CSRF)
Type: CWE
CWE ID: CWE-384
Description: CWE-384: Session Fixation
Type: CWE
CWE ID: CWE-352
Description: CWE-352: Cross-Site Request Forgery (CSRF)
Metrics
VersionBase scoreBase severityVector
3.18.1HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
x_refsource_CONFIRM
https://authjs.dev/reference/core/providers#checks
x_refsource_MISC
https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
x_refsource_MISC
https://next-auth.js.org/configuration/initialization#advanced-initialization
x_refsource_MISC
https://next-auth.js.org/configuration/providers/oauth
x_refsource_MISC
https://www.rfc-editor.org/rfc/rfc6749#section-10.12
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20230420-0006/
N/A
Hyperlink: https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
Resource:
x_refsource_CONFIRM
Hyperlink: https://authjs.dev/reference/core/providers#checks
Resource:
x_refsource_MISC
Hyperlink: https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
Resource:
x_refsource_MISC
Hyperlink: https://next-auth.js.org/configuration/initialization#advanced-initialization
Resource:
x_refsource_MISC
Hyperlink: https://next-auth.js.org/configuration/providers/oauth
Resource:
x_refsource_MISC
Hyperlink: https://www.rfc-editor.org/rfc/rfc6749#section-10.12
Resource:
x_refsource_MISC
Hyperlink: https://security.netapp.com/advisory/ntap-20230420-0006/
Resource: N/A
â–¼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
x_refsource_CONFIRM
x_transferred
https://authjs.dev/reference/core/providers#checks
x_refsource_MISC
x_transferred
https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
x_refsource_MISC
x_transferred
https://next-auth.js.org/configuration/initialization#advanced-initialization
x_refsource_MISC
x_transferred
https://next-auth.js.org/configuration/providers/oauth
x_refsource_MISC
x_transferred
https://www.rfc-editor.org/rfc/rfc6749#section-10.12
x_refsource_MISC
x_transferred
https://security.netapp.com/advisory/ntap-20230420-0006/
x_transferred
Hyperlink: https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: https://authjs.dev/reference/core/providers#checks
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://next-auth.js.org/configuration/initialization#advanced-initialization
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://next-auth.js.org/configuration/providers/oauth
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://www.rfc-editor.org/rfc/rfc6749#section-10.12
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://security.netapp.com/advisory/ntap-20230420-0006/
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:09 Mar, 2023 | 21:15
Updated At:20 Apr, 2023 | 09:15

NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary3.18.1HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Type: Primary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CPE Matches
nextauth.js
nextauth.js
>>next-auth>>Versions before 4.20.1(exclusive)
cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:*
Weaknesses
CWE IDTypeSource
CWE-352Primarysecurity-advisories@github.com
CWE-384Primarysecurity-advisories@github.com
CWE ID: CWE-352
Type: Primary
Source: security-advisories@github.com
CWE ID: CWE-384
Type: Primary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://authjs.dev/reference/core/providers#checkssecurity-advisories@github.com
Product
https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/security-advisories@github.com
Not Applicable
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qfsecurity-advisories@github.com
Exploit
Vendor Advisory
https://next-auth.js.org/configuration/initialization#advanced-initializationsecurity-advisories@github.com
Product
https://next-auth.js.org/configuration/providers/oauthsecurity-advisories@github.com
Product
https://security.netapp.com/advisory/ntap-20230420-0006/security-advisories@github.com
N/A
https://www.rfc-editor.org/rfc/rfc6749#section-10.12security-advisories@github.com
Not Applicable
Hyperlink: https://authjs.dev/reference/core/providers#checks
Source: security-advisories@github.com
Resource:
Product
Hyperlink: https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
Source: security-advisories@github.com
Resource:
Not Applicable
Hyperlink: https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
Source: security-advisories@github.com
Resource:
Exploit
Vendor Advisory
Hyperlink: https://next-auth.js.org/configuration/initialization#advanced-initialization
Source: security-advisories@github.com
Resource:
Product
Hyperlink: https://next-auth.js.org/configuration/providers/oauth
Source: security-advisories@github.com
Resource:
Product
Hyperlink: https://security.netapp.com/advisory/ntap-20230420-0006/
Source: security-advisories@github.com
Resource: N/A
Hyperlink: https://www.rfc-editor.org/rfc/rfc6749#section-10.12
Source: security-advisories@github.com
Resource:
Not Applicable

Change History

0
Information is not available yet

Similar CVEs

2419Records found
CVE-2021-22927
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-8.1||HIGH
EPSS-0.27% / 50.02%
||
7 Day CHG~0.00%
Published-05 Aug, 2021 | 20:16
Updated-03 Aug, 2024 | 18:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Action-Not Available
Vendor-n/aCitrix (Cloud Software Group, Inc.)
Product-mpx_15100-50g_fipsmpx\/sdx_14030_fipsmpx_15060-50g_fipsnetscaler_gatewayapplication_delivery_controllergatewaympx_15120-50g_fipsmpx_8910_fipsmpx_15030-50g_fipsmpx_8920_fipsmpx\/sdx_14080_fipsmpx_15040-50g_fipsmpx_15080-50g_fipsmpx\/sdx_14060_fipsapplication_delivery_controller_firmwarempx_8905_fipsCitrix ADC, Citrix Gateway
CWE ID-CWE-384
Session Fixation
CVE-2021-23431
Matching Score-4
Assigner-Snyk
ShareView Details
Matching Score-4
Assigner-Snyk
CVSS Score-5.4||MEDIUM
EPSS-0.14% / 33.70%
||
7 Day CHG~0.00%
Published-24 Aug, 2021 | 07:45
Updated-17 Sep, 2024 | 03:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cross-site Request Forgery (CSRF)

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

Action-Not Available
Vendor-joplinappn/a
Product-joplinjoplin
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-50858
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 33.65%
||
7 Day CHG~0.00%
Published-14 Jan, 2025 | 00:00
Updated-06 Jun, 2025 | 15:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.

Action-Not Available
Vendor-gestioipn/a
Product-gestioipn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-24380
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.10% / 27.83%
||
7 Day CHG~0.00%
Published-17 Dec, 2023 | 09:46
Updated-02 Aug, 2024 | 10:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Simple Wp Sitemap Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Webbjocke Simple Wp Sitemap.This issue affects Simple Wp Sitemap: from n/a through 1.2.1.

Action-Not Available
Vendor-webbjockeWebbjocke
Product-simple_wp_sitemapSimple Wp Sitemap
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16993
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.22% / 44.53%
||
7 Day CHG~0.00%
Published-30 Sep, 2019 | 11:30
Updated-05 Aug, 2024 | 01:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

Action-Not Available
Vendor-phpbbn/aDebian GNU/Linux
Product-phpbbdebian_linuxn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16667
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-56.10% / 98.04%
||
7 Day CHG~0.00%
Published-26 Sep, 2019 | 18:38
Updated-05 Aug, 2024 | 01:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.

Action-Not Available
Vendor-netgaten/a
Product-pfsensen/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2015-7715
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 33.51%
||
7 Day CHG~0.00%
Published-18 Oct, 2017 | 18:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.

Action-Not Available
Vendor-realtynan/a
Product-realtyna_property_listingn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2015-7563
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-8.8||HIGH
EPSS-0.13% / 32.02%
||
7 Day CHG~0.00%
Published-12 Apr, 2017 | 22:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user.

Action-Not Available
Vendor-teampassn/a
Product-teampassn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16531
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.28% / 50.96%
||
7 Day CHG~0.00%
Published-20 Sep, 2019 | 00:47
Updated-05 Aug, 2024 | 01:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

Action-Not Available
Vendor-layerbbn/a
Product-layerbbn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-15934
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.16% / 37.30%
||
7 Day CHG~0.00%
Published-12 Dec, 2019 | 13:40
Updated-05 Aug, 2024 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Intesync Solismed 3.3sp has CSRF.

Action-Not Available
Vendor-intesyncn/a
Product-solismedn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49290
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.40% / 60.03%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:14
Updated-22 Oct, 2024 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.

Action-Not Available
Vendor-boxystudioGora Tech LLC
Product-cookedCooked Pro
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-23227
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.14% / 33.92%
||
7 Day CHG~0.00%
Published-13 Jan, 2022 | 20:27
Updated-20 Feb, 2025 | 20:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.

Action-Not Available
Vendor-php_everywhere_projectAlexander Fuchs
Product-php_everywherePHP Everywhere (WordPress plugin)
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49306
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.19% / 41.15%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:13
Updated-22 Oct, 2024 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WP-buy WP Content Copy Protection & No Right Click allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through 3.5.9.

Action-Not Available
Vendor-wp-buyWP-buy
Product-wp_content_copy_protection_\&_no_right_clickWP Content Copy Protection & No Right Click
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2012-10015
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-4.3||MEDIUM
EPSS-0.07% / 20.28%
||
7 Day CHG~0.00%
Published-30 May, 2023 | 23:31
Updated-06 Aug, 2024 | 21:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
BestWebSoft Twitter Plugin Settings Page twitter.php twttr_settings_page cross-site request forgery

A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.

Action-Not Available
Vendor-BestWebSoft
Product-twitterTwitter Plugin
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16311
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.18% / 39.82%
||
7 Day CHG~0.00%
Published-14 Sep, 2019 | 15:22
Updated-05 Aug, 2024 | 01:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NIUSHOP V1.11 has CSRF via search&#95;info to index.php.

Action-Not Available
Vendor-niushopn/a
Product-niushopn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16326
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.82% / 73.92%
||
7 Day CHG~0.00%
Published-26 Dec, 2019 | 17:27
Updated-05 Aug, 2024 | 01:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and device compromise. NOTE: this is an end-of-life product.

Action-Not Available
Vendor-n/aD-Link Corporation
Product-dir-601_firmwaredir-601n/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-23404
Matching Score-4
Assigner-Snyk
ShareView Details
Matching Score-4
Assigner-Snyk
CVSS Score-7.6||HIGH
EPSS-0.14% / 34.23%
||
7 Day CHG~0.00%
Published-08 Sep, 2021 | 10:50
Updated-16 Sep, 2024 | 18:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cross-site Request Forgery (CSRF)

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.

Action-Not Available
Vendor-sqlite-web_projectn/a
Product-sqlite-websqlite-web
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16513
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.22% / 44.75%
||
7 Day CHG~0.00%
Published-23 Jan, 2020 | 17:11
Updated-05 Aug, 2024 | 01:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.

Action-Not Available
Vendor-connectwisen/a
Product-controln/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-23897
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-40.06% / 97.23%
||
7 Day CHG~0.00%
Published-10 Jul, 2023 | 12:14
Updated-02 Aug, 2024 | 14:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Simple Mobile URL Redirect Plugin <= 1.7.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.

Action-Not Available
Vendor-ozetteOzette Plugins
Product-simple_mobile_url_redirectSimple Mobile URL Redirect
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49274
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.14% / 34.75%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:22
Updated-22 Oct, 2024 | 18:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Staff VOD Infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.7.

Action-Not Available
Vendor-infomaniakInfomaniak Staff
Product-vod_infomaniakVOD Infomaniak
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16706
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.18% / 39.82%
||
7 Day CHG~0.00%
Published-23 Sep, 2019 | 11:00
Updated-05 Aug, 2024 | 01:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.

Action-Not Available
Vendor-kkcms_projectn/a
Product-kkcmsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-48962
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-8.9||HIGH
EPSS-0.24% / 46.99%
||
7 Day CHG~0.00%
Published-18 Nov, 2024 | 08:41
Updated-11 Feb, 2025 | 16:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Action-Not Available
Vendor-The Apache Software Foundation
Product-ofbizApache OFBizofbiz
CWE ID-CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2024-49272
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.20% / 41.95%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:23
Updated-22 Oct, 2024 | 18:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WPWeb Social Auto Poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through 5.3.15.

Action-Not Available
Vendor-WPWeb Elite
Product-social_auto_posterSocial Auto Poster
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-16573
Matching Score-4
Assigner-Jenkins Project
ShareView Details
Matching Score-4
Assigner-Jenkins Project
CVSS Score-8.8||HIGH
EPSS-0.11% / 29.45%
||
7 Day CHG~0.00%
Published-17 Dec, 2019 | 14:40
Updated-05 Aug, 2024 | 01:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Action-Not Available
Vendor-Jenkins
Product-alauda_devops_pipelineJenkins Alauda DevOps Pipeline Plugin
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49628
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.29% / 51.61%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:10
Updated-22 Oct, 2024 | 18:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WhileTrue Most And Least Read Posts Widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.18.

Action-Not Available
Vendor-whiletrueWhileTrue
Product-most_and_least_read_posts_widgetMost And Least Read Posts Widget
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49615
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-8.2||HIGH
EPSS-0.10% / 26.85%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 09:57
Updated-22 Oct, 2024 | 16:43
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through 1.0.0.

Action-Not Available
Vendor-henriquerodriguesHenrique Rodrigues
Product-safetyformsSafetyForms
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-2497
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.51%
||
7 Day CHG~0.00%
Published-22 Nov, 2023 | 15:33
Updated-02 Aug, 2024 | 06:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Action-Not Available
Vendor-userpropluginn/a
Product-userproUserPro - Community and User Profile WordPress Plugin
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49621
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-8.2||HIGH
EPSS-0.06% / 19.42%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 09:05
Updated-24 Oct, 2024 | 15:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Apa APA Register Newsletter Form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through 1.0.0.

Action-Not Available
Vendor-apaApa
Product-apa_register_newsletter_formAPA Register Newsletter Form
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49685
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.14% / 34.75%
||
7 Day CHG~0.00%
Published-31 Oct, 2024 | 09:59
Updated-05 Feb, 2025 | 14:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through 2.2.3.

Action-Not Available
Vendor-Smash Balloon, LLC (Smash Balloon)
Product-custom_twitter_feedsCustom Twitter Feeds (Tweets Widget)
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-49250
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.20% / 41.95%
||
7 Day CHG~0.00%
Published-20 Oct, 2024 | 10:28
Updated-22 Oct, 2024 | 18:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through 2408.

Action-Not Available
Vendor-dublueMichael Tran
Product-table_of_contents_plusTable of Contents Plus
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-4757
Matching Score-4
Assigner-WPScan
ShareView Details
Matching Score-4
Assigner-WPScan
CVSS Score-8.1||HIGH
EPSS-0.39% / 59.42%
||
7 Day CHG~0.00%
Published-25 Jun, 2024 | 06:00
Updated-19 May, 2025 | 21:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF

The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Action-Not Available
Vendor-wp-masterUnknownlogo_manager_for_enamad
Product-logo_manager_for_enamadLogo Manager For Enamadlogo_manager_for_enamad
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23997
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.09% / 25.87%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 07:39
Updated-11 Oct, 2024 | 16:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Database Collation Fix Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.

Action-Not Available
Vendor-database_collation_fix_projectDave Jesch
Product-database_collation_fixDatabase Collation Fix
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-23861
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.07% / 20.75%
||
7 Day CHG~0.00%
Published-29 Mar, 2023 | 12:50
Updated-10 Jan, 2025 | 19:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress GMAce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.

Action-Not Available
Vendor-gmace_projectGerman Mesky
Product-gmaceGMAce
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-15040
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.00% / 0.04%
||
7 Day CHG~0.00%
Published-02 Oct, 2019 | 18:32
Updated-05 Aug, 2024 | 00:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.

Action-Not Available
Vendor-n/aJetBrains s.r.o.
Product-youtrackn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-22954
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-8.8||HIGH
EPSS-0.15% / 35.37%
||
7 Day CHG~0.00%
Published-09 Feb, 2022 | 22:05
Updated-03 Aug, 2024 | 18:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.

Action-Not Available
Vendor-concretecmsn/a
Product-concrete_cmshttps://github.com/concrete5/concrete5
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2022-2233
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-8.8||HIGH
EPSS-0.32% / 54.52%
||
7 Day CHG~0.00%
Published-06 Sep, 2022 | 17:18
Updated-05 May, 2025 | 17:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabc_admin_slides_postback() function found in the ~/admin/admin.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link

Action-Not Available
Vendor-banner_cycler_projectjkriddle
Product-banner_cyclerBanner Cycler
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-15150
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.29% / 51.79%
||
7 Day CHG~0.00%
Published-19 Aug, 2019 | 03:41
Updated-05 Aug, 2024 | 00:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.

Action-Not Available
Vendor-schine.gamesn/a
Product-mw-oauth2clientn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-32588
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.07% / 22.19%
||
7 Day CHG~0.00%
Published-13 Nov, 2023 | 01:14
Updated-28 Aug, 2024 | 18:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Post State Tags Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in BRANDbrilliance Post State Tags plugin <= 2.0.6 versions.

Action-Not Available
Vendor-brandbrillianceBRANDbrilliance
Product-post_state_tagsPost State Tags
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-23890
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-7.1||HIGH
EPSS-0.09% / 25.38%
||
7 Day CHG+0.02%
Published-20 May, 2023 | 22:30
Updated-09 Jan, 2025 | 15:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Airbnb Review Slider Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in LJ Apps WP Airbnb Review Slider plugin <= 3.2 versions.

Action-Not Available
Vendor-ljappsLJ Apps
Product-wp_airbnb_review_sliderWP Airbnb Review Slider
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-15089
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.23%
||
7 Day CHG~0.00%
Published-20 Sep, 2019 | 13:43
Updated-05 Aug, 2024 | 00:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.

Action-Not Available
Vendor-prisen/a
Product-adasn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-47879
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-7.6||HIGH
EPSS-0.10% / 28.06%
||
7 Day CHG~0.00%
Published-24 Oct, 2024 | 20:17
Updated-04 Dec, 2024 | 17:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.

Action-Not Available
Vendor-openrefineOpenRefineopenrefine
Product-openrefineOpenRefineopenrefine
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2024-48311
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.10% / 26.50%
||
7 Day CHG~0.00%
Published-31 Oct, 2024 | 00:00
Updated-22 May, 2025 | 17:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

Action-Not Available
Vendor-n/aPiwigo
Product-piwigon/apiwigo
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-23026
Matching Score-4
Assigner-F5, Inc.
ShareView Details
Matching Score-4
Assigner-F5, Inc.
CVSS Score-8.8||HIGH
EPSS-0.30% / 53.06%
||
7 Day CHG~0.00%
Published-14 Sep, 2021 | 21:57
Updated-03 Aug, 2024 | 18:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Action-Not Available
Vendor-n/aF5, Inc.
Product-big-ip_ssl_orchestratorbig-ip_application_acceleration_managerbig-ip_advanced_web_application_firewallbig-ip_link_controllerbig-ip_policy_enforcement_managerbig-ip_fraud_protection_servicebig-iq_centralized_managementbig-ip_global_traffic_managerbig-ip_analyticsbig-ip_access_policy_managerbig-ip_domain_name_systembig-ip_local_traffic_managerbig-ip_advanced_firewall_managerbig-ip_application_security_managerbig-ip_ddos_hybrid_defenderBIG-IP & BIG-IQ
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-46086
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.18% / 39.85%
||
7 Day CHG~0.00%
Published-18 Sep, 2024 | 00:00
Updated-25 Sep, 2024 | 17:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123

Action-Not Available
Vendor-frogcms_projectn/afrogcms_project
Product-frogcmsn/afrogcms
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-24395
Matching Score-4
Assigner-Patchstack
ShareView Details
Matching Score-4
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.09% / 26.16%
||
7 Day CHG~0.00%
Published-10 Jul, 2023 | 10:40
Updated-18 Oct, 2024 | 13:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Contact Form 7 Redirect & Thank You Page Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.

Action-Not Available
Vendor-wppluginScott Paterson
Product-contact_form_7_redirect_\&_thank_you_pageContact Form 7 Redirect & Thank You Page
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-14836
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-8.8||HIGH
EPSS-0.12% / 31.59%
||
7 Day CHG-0.18%
Published-26 May, 2021 | 11:18
Updated-05 Aug, 2024 | 00:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-3scaleRed Hat 3scale API Management
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2023-24446
Matching Score-4
Assigner-Jenkins Project
ShareView Details
Matching Score-4
Assigner-Jenkins Project
CVSS Score-8.8||HIGH
EPSS-0.18% / 39.91%
||
7 Day CHG~0.00%
Published-24 Jan, 2023 | 00:00
Updated-02 Apr, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.

Action-Not Available
Vendor-Jenkins
Product-openidJenkins OpenID Plugin
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-46394
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8||HIGH
EPSS-0.16% / 36.94%
||
7 Day CHG~0.00%
Published-19 Sep, 2024 | 00:00
Updated-25 Sep, 2024 | 16:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add

Action-Not Available
Vendor-frogcms_projectn/afrogcms_project
Product-frogcmsn/afrogcms
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-13370
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.13% / 33.10%
||
7 Day CHG~0.00%
Published-06 Jul, 2019 | 21:48
Updated-04 Aug, 2024 | 23:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.

Action-Not Available
Vendor-ignitedcmsn/a
Product-ignitedcmsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-14304
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.21% / 43.16%
||
7 Day CHG~0.00%
Published-10 Jan, 2020 | 17:58
Updated-05 Aug, 2024 | 00:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Ricoh SP C250DN 1.06 devices allow CSRF.

Action-Not Available
Vendor-n/aRicoh Company, Ltd.
Product-mp_2014_firmwaresp_c252sf_firmwaresp_c250dnsp_213suwm_2701sp_3710dn_firmwaresp_c261dnw_firmwaresp_221sfnwsp_c261sfnwsp_221sfnw_firmwarem_2701_firmwaresp_212sfwsp_277snwx_firmwarep_c300wsp_c261dnwsp_c252sfsp_221nwsp_220snwsp_213nw_\(taiwan\)sp_220sfnwsp_220nw_firmwarem_c250fwbsp_c261sfnw_firmwaresp_c250dn_firmwaresp_c262sfnw_firmwaresp_212wsp_213nw_firmwaremp_2014sp_213w_firmwaresp_330sfnsp_c250sf_firmwarem_c250fw_firmwarep_c301w_firmwaresp_212sfnw_\(china\)sp_c260sfnwsp_c260dnwsp_330snsp_212sfnw_firmwarem_2700sp_212w_firmwaresp_213suw_firmwarem_c250fwsp_221snwsp_221sf_firmwaresp_213sfwsp_213nwsp_277snwxsp_213sfnw_\(taiwan\)_firmwaresp_212snwsp277nwxsp_277sfnwxsp_330sn_firmwaresp_c260dnw_firmwaresp_c262dnw_firmwaresp_330dn_firmwaresp_212sfnw_\(china\)_firmwaresp_220sfnw_firmwaresp_213sfw_firmwarep_c301wsp_221_firmwaresp_212sfw_firmwarep_c300w_firmwaresp_220nwsp_213nw_\(taiwan\)_firmwaresp_213sfnw_firmwaresp_212snw_firmwaresp_c262dnwsp_330sfn_firmwaremp_2014adsp_c252dn_firmwaresp_212suwm_2700_firmwaresp_213snwsp_213snw_\(taiwan\)_firmwaresp277nwx_firmwaresp_330dnmp_2014ad_firmwaresp_3710sf_firmwaresp_221sp_3710sfsp_220snw_firmwaresp_212suw_firmwarem_c250fwb_firmwaresp_221s_firmwaresp_213wsp_c262sfnwsp_3710dnsp_213sfnw_\(taiwan\)sp_213snw_firmwaresp_213snw_\(taiwan\)sp_221sfsp_c250sfsp_221snw_firmwaresp_212sfnwsp_213sfnwsp_277sfnwx_firmwaresp_212nw_firmwaresp_c260sfnw_firmwaresp_212nwsp_c252dnmp_2014dmp_2014d_firmwaresp_221ssp_221nw_firmwaren/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
  • Previous
  • 1
  • 2
  • 3
  • 4
  • ...
  • 48
  • 49
  • Next
Details not found