# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset](https://agentprime.io/advisories/CVE-2025-10308.md)
  `CVE-2025-10308` · CVE record: alian Astro Booking Engine · CVSS 4.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [francoisjacquet RosarioSIS Modules.php cross-site request forgery](https://agentprime.io/advisories/CVE-2026-19786.md)
  `CVE-2026-19786` · CVE record: francoisjacquet RosarioSIS · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager](https://agentprime.io/advisories/CVE-2026-17069.md)
  `CVE-2026-17069` · CVE record: IBM i · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [IBM Planning Analytics Local is affected by security vulnerabilities](https://agentprime.io/advisories/CVE-2026-13365.md)
  `CVE-2026-13365` · CVE record: IBM Planning Analytics · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72658.md)
  `CVE-2026-72658` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php](https://agentprime.io/advisories/CVE-2026-73482.md)
  `CVE-2026-73482` · CVE record: phplist phplist3 · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules](https://agentprime.io/advisories/CVE-2026-73481.md)
  `CVE-2026-73481` · CVE record: phplist phplist3 · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Zimbra Collaboration](https://agentprime.io/advisories/CVE-2026-73575.md)
  `CVE-2026-73575` · CVE record: Zimbra Collaboration · CVSS 3.1 Low · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [HCL AION is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2025-62318.md)
  `CVE-2025-62318` · CVE record: HCL Software AION · CVSS 3.7 Low · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication](https://agentprime.io/advisories/CVE-2026-19088.md)
  `CVE-2026-19088` · CVE record: Unknown ShopEngine Elementor WooCommerce Builder Addon · CVSS 5.4 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers.](https://agentprime.io/advisories/CVE-2026-67990.md)
  `CVE-2026-67990` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie](https://agentprime.io/advisories/CVE-2026-48551.md)
  `CVE-2026-48551` · CVE record: Nagios Enterprises, LLC. Nagios Core and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes](https://agentprime.io/advisories/CVE-2026-73162.md)
  `CVE-2026-73162` · CVE record: MISP cti-transmute · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Multiple vulnerabilities in SAP Business AI Platform (Approuter)](https://agentprime.io/advisories/CVE-2026-66775.md)
  `CVE-2026-66775` · CVE record: SAP_SE SAP Business AI Platform (Approuter) · CVSS 4.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [PingFederate Administrative Console CSRF weaknesses](https://agentprime.io/advisories/CVE-2025-32736.md)
  `CVE-2025-32736` · CVE record: Ping Identity PingFederate · CVSS 4.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher](https://agentprime.io/advisories/CVE-2026-72578.md)
  `CVE-2026-72578` · CVE record: FreePBX FreePBX Framework · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-66642.md)
  `CVE-2026-66642` · CVE record: WP Umbrella WP Umbrella · CVSS 5.4 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure](https://agentprime.io/advisories/CVE-2026-19074.md)
  `CVE-2026-19074` · CVE record: Unknown Advanced Classifieds & Directory Pro · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Information disclosure, Cross-site request forgery (CSRF)
- [Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status](https://agentprime.io/advisories/CVE-2026-16965.md)
  `CVE-2026-16965` · CVE record: Unknown Solace Extra · CVSS 4.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-46409.md)
  `CVE-2026-46409` · CVE record: openyak openyak · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Code injection, Authentication bypass, Cross-site request forgery (CSRF), CWE-346
- [Estatik < 4.3.3 - Login CSRF](https://agentprime.io/advisories/CVE-2026-16262.md)
  `CVE-2026-16262` · CVE record: Unknown Estatik Real Estate Plugin · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-66686.md)
  `CVE-2026-66686` · CVE record: Vladimir Garagulya Plugins Garbage Collector (Database Cleanup) · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-66681.md)
  `CVE-2026-66681` · CVE record: Jeff Farthing Theme My Login · CVSS 4.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2026-28172.md)
  `CVE-2026-28172` · CVE record: Data443 Risk Mitigation, Inc. Tracking Code Manager · CVSS 7.1 High · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration](https://agentprime.io/advisories/CVE-2026-70556.md)
  `CVE-2026-70556` · CVE record: Hubzilla Hubzilla · CVSS 5.1 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions](https://agentprime.io/advisories/CVE-2025-13394.md)
  `CVE-2025-13394` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF](https://agentprime.io/advisories/CVE-2026-14204.md)
  `CVE-2026-14204` · CVE record: Unknown Google Authenticator · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR](https://agentprime.io/advisories/CVE-2026-14313.md)
  `CVE-2026-14313` · CVE record: Unknown PeproDev WooCommerce Receipt Uploader · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Livebook Teams identity callback lacks state binding, allowing login CSRF](https://agentprime.io/advisories/GHSA-pvvw-28fw-c6fg.md)
  `GHSA-pvvw-28fw-c6fg`, `CVE-2026-66885`, `EEF-CVE-2026-66885` · Hex `livebook`: affected `>=0.15.0, <0.18.7 || >=0.19.0, <0.19.9`, fixed in `0.18.7`, `0.19.9` · CVSS 6.8 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Jenkins Project Jenkins SCM-Manager Plugin](https://agentprime.io/advisories/CVE-2026-70434.md)
  `CVE-2026-70434` · CVE record: Jenkins Project Jenkins SCM-Manager Plugin · CVSS 4.2 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Jenkins Project Jenkins Multijob Plugin](https://agentprime.io/advisories/CVE-2026-70432.md)
  `CVE-2026-70432` · CVE record: Jenkins Project Jenkins Multijob Plugin · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Progress MarkLogic Server Admin UI](https://agentprime.io/advisories/CVE-2026-7326.md)
  `CVE-2026-7326` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack](https://agentprime.io/advisories/CVE-2026-71273.md)
  `CVE-2026-71273` · CVE record: openshwprojects OpenBK7231T_App · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2026-60009.md)
  `CVE-2026-60009` · CVE record: Eclipse Foundation Eclipse Theia · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal, Authentication bypass, Cross-site request forgery (CSRF)
- [Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE](https://agentprime.io/advisories/CVE-2026-70376.md)
  `CVE-2026-70376` · CVE record: pluck-cms Pluck CMS · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-7444.md)
  `CVE-2026-7444` · CVE record: cornelraiu-1 Search Analytics for WP · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item](https://agentprime.io/advisories/CVE-2026-17515.md)
  `CVE-2026-17515` · CVE record: Unknown MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Information disclosure, Cross-site request forgery (CSRF)
- [GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF](https://agentprime.io/advisories/CVE-2026-16613.md)
  `CVE-2026-16613` · CVE record: Unknown GDPR Cookie Compliance · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [RackTables cross-site request forgery](https://agentprime.io/advisories/CVE-2026-18819.md)
  `CVE-2026-18819` · CVE record: RackTables · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection](https://agentprime.io/advisories/GHSA-fg66-w5gp-22cr.md)
  `GHSA-fg66-w5gp-22cr`, `CVE-2026-66884`, `EEF-CVE-2026-66884` · Hex `oidcc_plug`: affected `>=0.2.0-beta.1, <0.5.0`, fixed in `0.5.0` · CVSS 2.1 Low · Not analysed yet · Published 4 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Admidio before 5.0.11 CSRF via category-report preferences](https://agentprime.io/advisories/CVE-2026-69093.md)
  `CVE-2026-69093` · CVE record: Admidio admidio · CVSS 7.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in the Administrative User Deletion Endpoint](https://agentprime.io/advisories/CVE-2026-69082.md)
  `CVE-2026-69082` · CVE record: misp cti-transmute · CVSS 8.8 High · Not analysed yet · Published 3 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF](https://agentprime.io/advisories/CVE-2026-16292.md)
  `CVE-2026-16292` · CVE record: Unknown Frontend File Manager Plugin · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset](https://agentprime.io/advisories/CVE-2026-12586.md)
  `CVE-2026-12586` · CVE record: Unknown Lenxel WP · CVSS 8.1 High · Not analysed yet · Published 2 Aug 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match](https://agentprime.io/advisories/CVE-2026-15988.md)
  `CVE-2026-15988` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 8.8 High · Not analysed yet · Published 1 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification](https://agentprime.io/advisories/CVE-2025-14469.md)
  `CVE-2025-14469` · CVE record: mndpsingh287 Theme Editor · CVSS 4.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-13729.md)
  `CVE-2026-13729` · CVE record: Unknown Podlove Podcast Publisher · CVSS 4.3 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [CSRF in PHP Jabbers scripts](https://agentprime.io/advisories/CVE-2025-67651.md)
  `CVE-2025-67651` · CVE record: PHP Jabbers Appointment Scheduler and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF).](https://agentprime.io/advisories/CVE-2026-50986.md)
  `CVE-2026-50986` · CVE record · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware](https://agentprime.io/advisories/CVE-2026-66416.md)
  `CVE-2026-66416` · CVE record: Leantime Leantime · CVSS 8.6 High · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache JSPWiki: JSPWiki vulnerable to JSON hijacking](https://agentprime.io/advisories/CVE-2026-28813.md)
  `CVE-2026-28813` · CVE record: Apache Software Foundation Apache JSPWiki · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling](https://agentprime.io/advisories/CVE-2026-44613.md)
  `CVE-2026-44613` · CVE record: Apache Software Foundation Apache Zeppelin · CVSS 6.1 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [CSRF in Softtr's E-Commerce Pack](https://agentprime.io/advisories/CVE-2026-5219.md)
  `CVE-2026-5219` · CVE record: Softtr Information Technology Trade Ltd. Co. E-Commerce Pack · CVSS 8.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle](https://agentprime.io/advisories/CVE-2026-5582.md)
  `CVE-2026-5582` · CVE record: fusewp FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Tourmaster < 5.4.8 - Stored XSS via CSRF](https://agentprime.io/advisories/CVE-2026-14239.md)
  `CVE-2026-14239` · CVE record: Unknown tourmaster · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-17936.md)
  `CVE-2026-17936` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Cross-site request forgery (CSRF), CWE-693
- [IBM WebSphere Application Server Liberty is affected by a cross-site request forgery](https://agentprime.io/advisories/CVE-2026-2482.md)
  `CVE-2026-2482` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 3.1 Low · Not analysed yet · Published 29 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2](https://agentprime.io/advisories/CVE-2026-65947.md)
  `CVE-2026-65947` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0](https://agentprime.io/advisories/CVE-2026-65944.md)
  `CVE-2026-65944` · CVE record: rolandd.com RO CSVI extension for Joomla · CVSS 8.8 High · Not analysed yet · Published 29 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-9720.md)
  `CVE-2026-9720` · CVE record: facturadorvirtual Facturación Electrónica Costa Rica · CVSS 4.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA3LTI5VDA3OjQ4OjAzLjE5NTAwMFoiLCJDVkUtMjAyNi05NzIwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTA4LTE0VDE1OjAzOjMyLjE4NTAwMFoiLCJDVkUtMjAyNi01NzQ2OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTA4LTE0VDE1OjAzOjMyLjE4NTAwMFoiLCJDVkUtMjAyNi01NzQ2OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.