# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Cross-Site Request Forgery in SOPlanning](https://agentprime.io/advisories/CVE-2026-40549.md)
  `CVE-2026-40549` · CVE record: SOPlanning SOPlanning · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Admidio PKCS#12 private key export action lacks CSRF protection](https://agentprime.io/advisories/GHSA-4rgq-38mh-9xqg.md)
  `GHSA-4rgq-38mh-9xqg`, `CVE-2026-47232`, `PKSA-94fb-rmqx-1b5r` · Packagist `admidio/admidio`: affected `<5.0.10`, fixed in `5.0.10` · CVSS 4.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Admidio: CSRF in SSO client \`enable\` action toggles SAML/OIDC clients without token validation](https://agentprime.io/advisories/GHSA-xg76-5qj2-2hhv.md)
  `GHSA-xg76-5qj2-2hhv`, `CVE-2026-47229`, `PKSA-7hzm-szv2-dny3` · Packagist `admidio/admidio`: affected `<5.0.10`, fixed in `5.0.10` · CVSS 5.4 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Admidio's CSRF in registration \`send_login\` mode resets arbitrary user passwords](https://agentprime.io/advisories/GHSA-mx25-j3rc-6w2w.md)
  `GHSA-mx25-j3rc-6w2w`, `CVE-2026-47228`, `PKSA-z3z8-m2ny-zj6b` · Packagist `admidio/admidio`: affected `<5.0.10`, fixed in `5.0.10` · CVSS 5.2 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [PHP-SHOP 1.0 Cross-Site Request Forgery via users.php](https://agentprime.io/advisories/CVE-2018-25397.md)
  `CVE-2018-25397` · CVE record: joeyrush PHP-SHOP master · CVSS 6.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php](https://agentprime.io/advisories/CVE-2018-25387.md)
  `CVE-2018-25387` · CVE record: Sitejo HaPe PKH · CVSS 6.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form](https://agentprime.io/advisories/CVE-2026-6075.md)
  `CVE-2026-6075` · CVE record: dglingren Media Library Assistant · CVSS 8.1 High · Not analysed yet · Published 29 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-35266.md)
  `CVE-2026-35266` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 7.9 High · Not analysed yet · Published 28 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter](https://agentprime.io/advisories/CVE-2026-6455.md)
  `CVE-2026-6455` · CVE record: yudiz WP Contact Form 7 DB Handler · CVSS 8.1 High · Not analysed yet · Published 28 May 2026 · Tags: Cross-site request forgery (CSRF)
- [PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink](https://agentprime.io/advisories/CVE-2026-9618.md)
  `CVE-2026-9618` · CVE record: peachpay PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter](https://agentprime.io/advisories/CVE-2026-7533.md)
  `CVE-2026-7533` · CVE record: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-hj3h-r49w-34wh.md)
  `GHSA-hj3h-r49w-34wh`, `CVE-2026-9674` · Maven `org.jenkins-ci.plugins:jenkins-multijob-plugin`: affected `<669.v9d96a`, fixed in `669.v9d96a` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-rf8w-7c3g-7h3g.md)
  `GHSA-rf8w-7c3g-7h3g`, `CVE-2026-48925` · Maven `org.jenkins-ci.plugins:github-integration-parent`: affected `<0.7.4`, fixed in `0.7.4` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page](https://agentprime.io/advisories/CVE-2026-8942.md)
  `CVE-2026-8942` · CVE record: lhughes33472 MetaMagic SEO Plugin · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter](https://agentprime.io/advisories/CVE-2026-8906.md)
  `CVE-2026-8906` · CVE record: rahulbhangale WP Promoter · CVSS 6.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product](https://agentprime.io/advisories/CVE-2026-49001.md)
  `CVE-2026-49001` · CVE record: ZTE ZXUniPOS NDS-LTE · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page](https://agentprime.io/advisories/CVE-2026-8708.md)
  `CVE-2026-8708` · CVE record: shra Genzel breadcrumbs · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-7614.md)
  `CVE-2026-7614` · CVE record: mkhfr Old Posts Highlighter · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-8903.md)
  `CVE-2026-8903` · CVE record: youtag Two-factor authentication (formerly IP Vault) · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter](https://agentprime.io/advisories/CVE-2026-8911.md)
  `CVE-2026-8911` · CVE record: godlessons WP AutoBuzz · CVSS 6.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function](https://agentprime.io/advisories/CVE-2026-8943.md)
  `CVE-2026-8943` · CVE record: rchmura GoStats for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-8941.md)
  `CVE-2026-8941` · CVE record: wmark CDN Linker lite · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass](https://agentprime.io/advisories/CVE-2026-8938.md)
  `CVE-2026-8938` · CVE record: nakamura1458 auto making JSON-LD · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-8939.md)
  `CVE-2026-8939` · CVE record: simonailie Search Simple Fields · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management](https://agentprime.io/advisories/CVE-2026-9236.md)
  `CVE-2026-9236` · CVE record: creativemindssolutions CM Ad Changer – A simple tool to control and optimize your site's banners · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.](https://agentprime.io/advisories/CVE-2026-30498.md)
  `CVE-2026-30498` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery](https://agentprime.io/advisories/CVE-2026-9582.md)
  `CVE-2026-9582` · CVE record: SourceCodester CET Automated Grading System with AI Predictive Analytics · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Joomla! Core - \[20260505\] - CSRF in user activation endpoint](https://agentprime.io/advisories/CVE-2026-35220.md)
  `CVE-2026-35220` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.6 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Weblate has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-hfpv-mc5v-p9mm.md)
  `GHSA-hfpv-mc5v-p9mm`, `CVE-2025-66407`, `PYSEC-2025-231` · PyPI `weblate`: affected `<5.15`, fixed in `5.15` · CVSS 5.0 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF)
- [e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()](https://agentprime.io/advisories/CVE-2026-46620.md)
  `CVE-2026-46620` · CVE record: e107inc e107 · CVSS 6.5 Medium · Not analysed yet · Published 26 May 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion](https://agentprime.io/advisories/GHSA-xjg6-5v39-v7fc.md)
  `GHSA-xjg6-5v39-v7fc`, `CVE-2026-8340`, `PKSA-ft53-g53d-bkdk` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site Request Forgery](https://agentprime.io/advisories/CVE-2026-8174.md)
  `CVE-2026-8174` · CVE record: Zohocorp Zoho Mail wordpress plugin · CVSS 5.7 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-39436.md)
  `CVE-2026-39436` · CVE record: bgermann CformsII · CVSS 7.1 High · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-24554.md)
  `CVE-2026-24554` · CVE record: Convers Lab WPSubscription · CVSS 4.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-24574.md)
  `CVE-2026-24574` · CVE record: Recorp Export WP Page to Static HTML/CSS · CVSS 6.5 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-24597.md)
  `CVE-2026-24597` · CVE record: WpDevArt Organization chart · CVSS 4.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [SourceCodester Student Grades Management System cross-site request forgery](https://agentprime.io/advisories/CVE-2026-9486.md)
  `CVE-2026-9486` · CVE record: SourceCodester Student Grades Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php](https://agentprime.io/advisories/CVE-2018-25370.md)
  `CVE-2018-25370` · CVE record: Admidio Admidio · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Twitter-Clone 1 Cross-Site Request Forgery via tweetdel.php](https://agentprime.io/advisories/CVE-2018-25363.md)
  `CVE-2018-25363` · CVE record: Fyffe PHP-Twitter-Clone · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Component jomres 9.11.2 Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2018-25354.md)
  `CVE-2018-25354` · CVE record: Jomres Jomres · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Smartshop 1 Cross-Site Request Forgery via editprofile.php](https://agentprime.io/advisories/CVE-2018-25343.md)
  `CVE-2018-25343` · CVE record: Behance Smartshop · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Cross-site request forgery (CSRF)
- [calcom cal.diy cross-site request forgery](https://agentprime.io/advisories/CVE-2026-9303.md)
  `CVE-2026-9303` · CVE record: calcom cal.diy · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [RT has broken CSRF protection for authenticated users](https://agentprime.io/advisories/CVE-2026-41074.md)
  `CVE-2026-41074` · CVE record: bestpractical rt · CVSS 7.1 High · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter](https://agentprime.io/advisories/CVE-2026-7615.md)
  `CVE-2026-7615` · CVE record: kasparsd Widget Context · CVSS 4.3 Medium · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter](https://agentprime.io/advisories/CVE-2026-4070.md)
  `CVE-2026-4070` · CVE record: pftool Alfie – Feed Plugin · CVSS 4.3 Medium · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder](https://agentprime.io/advisories/GHSA-xj25-753j-wgp9.md)
  `GHSA-xj25-753j-wgp9`, `CVE-2026-8415`, `PKSA-9s3m-thqq-9cfd` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete](https://agentprime.io/advisories/GHSA-v7c7-658v-hh7v.md)
  `GHSA-v7c7-658v-hh7v`, `CVE-2026-8410`, `PKSA-x9hx-5ky4-cyz2` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache](https://agentprime.io/advisories/GHSA-rv3q-xmfw-mcjv.md)
  `GHSA-rv3q-xmfw-mcjv`, `CVE-2026-8412`, `PKSA-ks9q-hdsh-jhd2` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)](https://agentprime.io/advisories/GHSA-qj94-6rx6-27fr.md)
  `GHSA-qj94-6rx6-27fr`, `CVE-2026-8416`, `PKSA-4vdj-385c-kbs8` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design](https://agentprime.io/advisories/GHSA-mpq2-mv8p-9wm6.md)
  `GHSA-mpq2-mv8p-9wm6`, `CVE-2026-8413`, `PKSA-jszb-q2pk-2pw4` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate](https://agentprime.io/advisories/GHSA-98qf-jvwj-2r5f.md)
  `GHSA-98qf-jvwj-2r5f`, `CVE-2026-8414`, `PKSA-9yjm-r5x4-kcxv` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()](https://agentprime.io/advisories/GHSA-97jw-gr4m-c5v8.md)
  `GHSA-97jw-gr4m-c5v8`, `CVE-2026-8432`, `PKSA-q99w-2v6k-kwsc` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete](https://agentprime.io/advisories/GHSA-752x-23hp-jmv6.md)
  `GHSA-752x-23hp-jmv6`, `CVE-2026-8411`, `PKSA-ngsw-3psq-jryj` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()](https://agentprime.io/advisories/GHSA-6qjh-p324-694f.md)
  `GHSA-6qjh-p324-694f`, `CVE-2026-8434`, `PKSA-15g8-fcvm-qwvy` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()](https://agentprime.io/advisories/GHSA-6fxm-r8p3-mx5c.md)
  `GHSA-6fxm-r8p3-mx5c`, `CVE-2026-8433`, `PKSA-1cn3-6pmf-71hx` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)](https://agentprime.io/advisories/GHSA-67hj-8239-cmf5.md)
  `GHSA-67hj-8239-cmf5`, `CVE-2026-8427`, `PKSA-d6mg-vz5r-sfbf` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete](https://agentprime.io/advisories/GHSA-56c9-xq5g-xrf9.md)
  `GHSA-56c9-xq5g-xrf9`, `CVE-2026-8409`, `PKSA-qzg4-w3py-ddfh` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()](https://agentprime.io/advisories/GHSA-44q4-354f-c826.md)
  `GHSA-44q4-354f-c826`, `CVE-2026-8435`, `PKSA-54fw-f2r8-pxcd` · Packagist `concrete5/concrete5`: affected `>=9.0.0RC1, <9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-1275
- [Concrete CMS is vulnerable to unauthorized file deletion](https://agentprime.io/advisories/GHSA-66rg-92q4-6m8q.md)
  `GHSA-66rg-92q4-6m8q`, `CVE-2026-7882`, `PKSA-fxgv-rp7s-m994` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Concrete CMS is Vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-prxr-vjgc-2cq9.md)
  `GHSA-prxr-vjgc-2cq9`, `CVE-2026-8428`, `PKSA-fqsc-qq8z-j29z` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: Cross-site request forgery (CSRF), CWE-829

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA1LTIxVDIxOjMwOjM4LjAwMDAwMFoiLCJHSFNBLXByeHItdmpnYy0yY3E5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTA2LTAxVDE5OjU5OjIyLjg1OTAwMFoiLCJDVkUtMjAyNi00OTQzMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTA2LTAxVDE5OjU5OjIyLjg1OTAwMFoiLCJDVkUtMjAyNi00OTQzMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.