cve.bz

CWE-352: Cross-Site Request Forgery (Cross Site Reference Forgery), page 151

Filter

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

What the weakness is: CWE-352 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
  • CAPEC-462 Cross-Domain Search Timing Severity: Medium
  • CAPEC-467 Cross Site Identification Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-352, as MITRE names them. Credits.

Ask an AI about CWE-352

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-352: Cross-Site Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/352.html and https://cve.bz/cve/cwe/352?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2015-9431EPSS 0.9%

    The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.

  2. 6.5CVE-2015-9429EPSS 0.9%

    The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.

  3. 6.5CVE-2015-9428EPSS 0.9%

    The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parame…

  4. 6.5CVE-2015-9427EPSS 1.1%

    The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.

  5. 5.4CVE-2015-9425EPSS 0.7%

    The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.

  6. 6.5CVE-2015-9424EPSS 0.9%

    The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.

  7. 6.5CVE-2015-9422EPSS 0.9%

    The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin,…

  8. 6.5CVE-2015-9421EPSS 0.9%

    The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.

  9. 4.3CVE-2015-9418EPSS 0.6%

    The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

  10. 6.5CVE-2015-9417EPSS 0.7%

    The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.

  11. 6.5CVE-2015-9413EPSS 1.1%

    The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.

  12. 6.5CVE-2015-9409EPSS 1.1%

    The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.

  13. 4.3CVE-2019-10408EPSS 0.6%

    A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates.

  14. 6.5CVE-2019-4515EPSS 0.5%

    IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 16513…

  15. 6.5CVE-2019-16721EPSS 0.5%

    NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.

  16. 6.5CVE-2019-16719EPSS 0.5%

    WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.

  17. 8.8CVE-2019-16706EPSS 0.6%

    kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.

  18. 6.5CVE-2019-16678EPSS 0.7%

    admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.

  19. 6.5CVE-2019-16677EPSS 0.5%

    An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.

  20. 8.8CVE-2019-16660EPSS 0.5%

    joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.

  21. 8.8CVE-2019-16659EPSS 0.5%

    TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.

  22. 8.8CVE-2019-16658EPSS 0.5%

    TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.

  23. 6.5CVE-2018-17789EPSS 0.7%

    Prospecta Master Data Online (MDO) allows CSRF.

  24. 6.5CVE-2015-9408EPSS 1.1%

    The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.

  25. 8.8CVE-2015-9394EPSS 0.7%

    The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

  26. 6.5CVE-2016-10997EPSS 0.8%

    The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.

  27. 6.5CVE-2015-9388EPSS 0.7%

    The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.

  28. 6.5CVE-2015-9387EPSS 0.7%

    The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.

  29. 8.8CVE-2019-15089EPSS 0.6%

    An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.

  30. 8.8CVE-2019-16531ExploitEPSS 2.5%

    LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

  31. 8.8CVE-2016-10989EPSS 0.9%

    The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.

  32. 8.8CVE-2016-10982EPSS 0.7%

    The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.

  33. 8.8CVE-2016-10978EPSS 0.7%

    The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.

  34. 8.8CVE-2016-10974EPSS 0.7%

    The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.

  35. 6.5CVE-2016-10962EPSS 0.6%

    The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.

  36. 8.8CVE-2019-16311EPSS 0.6%

    NIUSHOP V1.11 has CSRF via search_info to index.php.

  37. 4.3CVE-2019-13920EPSS 0.4%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cross Site Request Forgery (CSRF) attacks. The security vulnerability could be explo…

  38. 9.6CVE-2019-13364EPSS 1.4%

    admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat&#95;number, billing&#95;name, company, or billing&#95;address parameter. This is exploitable via CSRF.

  39. 9.6CVE-2019-13363EPSS 1.4%

    admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm&#95;send&#95;html&#95;mail, nbm&#95;send&#95;mail&#95;as, nbm&#95;send&#95;detailed&#95;content, nbm&#95;complementary&#95;mail&#95;content, nbm&#95;send&#95;recent&#9…

  40. 6.5CVE-2019-12922ExploitEPSS 11%

    A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

  41. 8.8CVE-2016-10946EPSS 0.8%

    The wp-d3 plugin before 2.4.1 for WordPress has CSRF.

  42. 8.8CVE-2016-10945EPSS 0.8%

    The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.

  43. 8.8CVE-2016-10944EPSS 0.7%

    The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.

  44. 6.5CVE-2016-10938EPSS 0.9%

    The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.

  45. 8.8CVE-2019-5993EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  46. 8.8CVE-2019-5992EPSS 0.9%

    Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  47. 8.8CVE-2019-5986EPSS 0.8%

    Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and…

  48. 8.8CVE-2019-1261EPSS 1.6%

    A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page sp…

  49. 8.8CVE-2019-1259EPSS 1.5%

    A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page sp…

  50. 6.5CVE-2019-14998EPSS 1.2%

    The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance.