# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations](https://agentprime.io/advisories/CVE-2026-103938.md)
  `CVE-2026-103938` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override](https://agentprime.io/advisories/CVE-2026-73099.md)
  `CVE-2026-73099` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Presenton User Configuration user-config JSON.parse cross-site request forgery](https://agentprime.io/advisories/CVE-2026-122151.md)
  `CVE-2026-122151` · CVE record: Presenton · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [nliautaud pico-content-editor cross-site request forgery](https://agentprime.io/advisories/CVE-2026-122144.md)
  `CVE-2026-122144` · CVE record: nliautaud pico-content-editor · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering](https://agentprime.io/advisories/CVE-2025-71454.md)
  `CVE-2025-71454` · CVE record: vtenext vtenext · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution](https://agentprime.io/advisories/CVE-2026-92704.md)
  `CVE-2026-92704` · CVE record: sharpemu sharpemu · CVSS 8.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-346, CWE-350
- [Cross-site request forgery in Akeeba Ltd. Akeeba Backup for Joomla! and others](https://agentprime.io/advisories/CVE-2026-105296.md)
  `CVE-2026-105296` · CVE record: Akeeba Ltd. Akeeba Backup for Joomla! and 3 more · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields](https://agentprime.io/advisories/CVE-2026-120640.md)
  `CVE-2026-120640` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console](https://agentprime.io/advisories/CVE-2026-110288.md)
  `CVE-2026-110288` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value](https://agentprime.io/advisories/CVE-2026-63433.md)
  `CVE-2026-63433` · CVE record: franklioxygen MyTube · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF](https://agentprime.io/advisories/CVE-2026-121451.md)
  `CVE-2026-121451` · CVE record: amir1376 ab-download-manager · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5](https://agentprime.io/advisories/CVE-2026-103420.md)
  `CVE-2026-103420` · CVE record: php-web-design.com StageIt extension for Joomla · CVSS 7.2 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes](https://agentprime.io/advisories/CVE-2026-120249.md)
  `CVE-2026-120249` · CVE record: Thelia Thelia Back-office Default Twig Template · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes](https://agentprime.io/advisories/CVE-2026-120207.md)
  `CVE-2026-120207` · CVE record: Thelia Thelia Page Module · CVSS 7.0 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions](https://agentprime.io/advisories/CVE-2026-120206.md)
  `CVE-2026-120206` · CVE record: Thelia Thelia and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-wm25-49w3-5qrg.md)
  `GHSA-wm25-49w3-5qrg`, `CVE-2026-96629`, `PKSA-1q5j-gcpm-qr2y` · Packagist `adminneo-org/adminneo`: affected `<5.5.1`, fixed in `5.5.1` · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, Cross-site request forgery (CSRF)
- [Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery](https://agentprime.io/advisories/CVE-2026-61826.md)
  `CVE-2026-61826` · CVE record: morpheus65535 bazarr · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-119466.md)
  `CVE-2026-119466` · CVE record: WPExperts APIExperts Square for WooCommerce · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-65566.md)
  `CVE-2026-65566` · CVE record: Meow Apps AI Engine · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Chamilo LMS: CSRF in destructive skill-management AJAX actions](https://agentprime.io/advisories/CVE-2026-45141.md)
  `CVE-2026-45141` · CVE record: chamilo chamilo-lms · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API](https://agentprime.io/advisories/CVE-2026-112374.md)
  `CVE-2026-112374` · CVE record: FOSSBilling FOSSBilling · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql](https://agentprime.io/advisories/CVE-2026-119426.md)
  `CVE-2026-119426` · CVE record: phpMyAdmin phpMyAdmin · CVSS 7.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters](https://agentprime.io/advisories/CVE-2026-119407.md)
  `CVE-2026-119407` · CVE record: element-hq element-web and 1 more · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217](https://agentprime.io/advisories/CVE-2026-107262.md)
  `CVE-2026-107262` · CVE record: Drupal Advanced Filesystem · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240](https://agentprime.io/advisories/CVE-2026-114541.md)
  `CVE-2026-114541` · CVE record: Drupal Frontend Editing · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258](https://agentprime.io/advisories/CVE-2026-118543.md)
  `CVE-2026-118543` · CVE record: Drupal Commerce Core · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263](https://agentprime.io/advisories/CVE-2026-118558.md)
  `CVE-2026-118558` · CVE record: Drupal Commerce Stripe · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283](https://agentprime.io/advisories/CVE-2026-118570.md)
  `CVE-2026-118570` · CVE record: Drupal Fasttoggle · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WeGIA: Systemic IDOR + Missing CSRF — extract($\_REQUEST) in All Controle Classes](https://agentprime.io/advisories/CVE-2026-61671.md)
  `CVE-2026-61671` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-27062.md)
  `CVE-2026-27062` · CVE record: WPFunnels Team WPFunnels · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-116399.md)
  `CVE-2026-116399` · CVE record: InstaWP InstaWP Connect · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application](https://agentprime.io/advisories/CVE-2026-5702.md)
  `CVE-2026-5702` · CVE record: SABBATIC SABBATIC app · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-110983.md)
  `CVE-2026-110983` · CVE record: Unknown WP Photo Album Plus · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-115300.md)
  `CVE-2026-115300` · CVE record: Unknown Contact Form by Supsystic · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF](https://agentprime.io/advisories/CVE-2026-115299.md)
  `CVE-2026-115299` · CVE record: Unknown Contact Form by Supsystic · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method](https://agentprime.io/advisories/GHSA-r7w9-592q-9vg4.md)
  `GHSA-r7w9-592q-9vg4`, `CVE-2026-118266`, `GO-2026-6877` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter](https://agentprime.io/advisories/CVE-2026-92797.md)
  `CVE-2026-92797` · CVE record: MemberPress Memberpress · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task](https://agentprime.io/advisories/CVE-2026-111120.md)
  `CVE-2026-111120` · CVE record: e4jvikwp VikRentCar Car Rental Management System · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-113486.md)
  `CVE-2026-113486` · CVE record: Unknown Media Library Assistant · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-113485.md)
  `CVE-2026-113485` · CVE record: Unknown Media Library Assistant · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/](https://agentprime.io/advisories/CVE-2015-20129.md)
  `CVE-2015-20129` · CVE record: CrushFTP CrushFTP · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-116863.md)
  `CVE-2026-116863` · CVE record: Tribulant Software Newsletters · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation](https://agentprime.io/advisories/CVE-2026-117536.md)
  `CVE-2026-117536` · CVE record: redaxo core · CVSS 8.6 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [REDAXO before 5.21.3 CSRF in Article History Plugin](https://agentprime.io/advisories/CVE-2026-117534.md)
  `CVE-2026-117534` · CVE record: redaxo core · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter](https://agentprime.io/advisories/CVE-2026-116895.md)
  `CVE-2026-116895` · CVE record: redaxo core · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions](https://agentprime.io/advisories/CVE-2026-116880.md)
  `CVE-2026-116880` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5](https://agentprime.io/advisories/CVE-2026-102787.md)
  `CVE-2026-102787` · CVE record: phoca.cz Phoca Download extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Ubiquiti Inc airMAX M](https://agentprime.io/advisories/CVE-2026-116839.md)
  `CVE-2026-116839` · CVE record: Ubiquiti Inc airMAX M · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Ubiquiti Inc airMAX M](https://agentprime.io/advisories/CVE-2026-116838.md)
  `CVE-2026-116838` · CVE record: Ubiquiti Inc airMAX M · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in boneIO](https://agentprime.io/advisories/CVE-2026-77058.md)
  `CVE-2026-77058` · CVE record: boneIO boneIO · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions](https://agentprime.io/advisories/CVE-2026-116210.md)
  `CVE-2026-116210` · CVE record: Webasyst Webasyst Framework · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-97295.md)
  `CVE-2026-97295` · CVE record: David Lingren Media LIbrary Assistant · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-111841.md)
  `CVE-2026-111841` · CVE record: Aman FunnelKit Automations · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.7.0 CSRF via despam Admin Action](https://agentprime.io/advisories/CVE-2026-116204.md)
  `CVE-2026-116204` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [LinkStackOrg LinkStack cross-site request forgery](https://agentprime.io/advisories/CVE-2026-116052.md)
  `CVE-2026-116052` · CVE record: LinkStackOrg LinkStack · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity](https://agentprime.io/advisories/CVE-2026-116072.md)
  `CVE-2026-116072` · CVE record: Docile-Alligator Infinity for Reddit · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Tenda F6 Web Management cross-site request forgery](https://agentprime.io/advisories/CVE-2026-115796.md)
  `CVE-2026-115796` · CVE record: Tenda F6 · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking](https://agentprime.io/advisories/CVE-2026-93631.md)
  `CVE-2026-93631` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [OS command injection in ASUS Router](https://agentprime.io/advisories/CVE-2026-75779.md)
  `CVE-2026-75779` · CVE record: ASUS Router · CVSS 8.6 High · Not analysed yet · Published 23 Oct 2026 · Tags: Command injection, Cross-site request forgery (CSRF)
- [Electron: SameSite cookie restrictions are not applied to windows opened from links](https://agentprime.io/advisories/GHSA-2p8c-gr87-2676.md)
  `GHSA-2p8c-gr87-2676`, `CVE-2026-113796` · npm `electron`: affected `<42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.6`, fixed in `42.11.3`, `43.7.0`, `44.3.0`, `45.0.0-alpha.6` · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)

Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTEwLTIyVDE2OjQ3OjU0LjAwMDAwMFoiLCJHSFNBLTJwOGMtZ3I4Ny0yNjc2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/>. Everything for agents: <https://agentprime.io/llms.txt>.