Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2022-50804 CVE record

CVSS 5.1 Medium

JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) Vulnerability
- JM-DATA ONU JF511-TV
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025
CVE-2025-52835 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability
- ConoHa by GMO WING WordPress Migrator
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025
CVE-2025-62112 CVE record

CVSS 4.3 Medium

WordPress Import into Easy Property Listings plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability
- Merv Barrett Import into Easy Property Listings
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025
CVE-2025-69021 CVE record

CVSS 5.4 Medium

WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Popup box
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025
CVE-2025-68998 CVE record

CVSS 5.4 Medium

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability
- Heateor Support Heateor Social Login
- Cross-site request forgery (CSRF)
Not analysed yet 30 Dec 2025
github.com/mattermost/mattermost-plugin-calls Go

CVSS 4.3 Medium

Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls
- Cross-site request forgery (CSRF)
<1.10.0 · fixed in 1.10.0

GHSA-gmx5-frv9-9m9f · CVE-2025-62190 Not analysed yet 30 Dec 2025
CVE-2024-30855 CVE record

CVSS 8.8 High

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
- Cross-site request forgery (CSRF)
Not analysed yet 29 Dec 2025
CVE-2025-67013 CVE record

CVSS 6.5 Medium

The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origi…
- Cross-site request forgery (CSRF)
Not analysed yet 26 Dec 2025
CVE-2019-25254 CVE record

CVSS 5.1 Medium

KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration
- KYOCERA Corporation KYOCERA Net Admin
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25252 CVE record

CVSS 5.1 Medium

Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change
- Teradek VidiU Pro
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25250 CVE record

CVSS 5.1 Medium

Devolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery
- devolo AG dLAN 550 duo+ Starter Kit
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25247 CVE record

CVSS 5.1 Medium

Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability
- Beward R&D Co., Ltd N100 H.264 VGA IP Camera
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25242 CVE record

CVSS 5.1 Medium

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface
- iWT Ltd. FaceSentry Access Control System
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25238 CVE record

CVSS 5.1 Medium

V-SOL GPON/EPON OLT Platform 2.03 Cross-Site Request Forgery Vulnerability
- Guangzhou V-SOLUTION Electronic Technology Co., Ltd. SOL GPON/EPON OLT Platform
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25234 CVE record

CVSS 5.1 Medium

Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS
- Carlo Gavazzi AB SmartHouse Webapp
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2019-25233 CVE record

CVSS 5.1 Medium

AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities
- AVE S.p.A. DOMINAplus
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25156 CVE record

CVSS 5.1 Medium

Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change
- Teradek, LLC Cube
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25155 CVE record

CVSS 5.1 Medium

Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change
- Teradek, LLC Slice
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25152 CVE record

CVSS 5.1 Medium

Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration
- Ecessa Corporation Ecessa Edge EV150
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25151 CVE record

CVSS 5.1 Medium

Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration
- Ecessa Corporation WANWorx WVR-30
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25150 CVE record

CVSS 5.1 Medium

Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration
- Ecessa Corporation Ecessa ShieldLink SL175EHQ
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25149 CVE record

CVSS 5.1 Medium

Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface
- Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway CSRF Vulnerabilities
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25133 CVE record

CVSS 5.1 Medium

Synaccess netBooter NP-0801DU 7.4 Cross-Site Request Forgery via Admin Interface
- Synaccess Networks Inc. netBooter NP-0801DU
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2018-25127 CVE record

CVSS 5.1 Medium

SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface
- SOCA Technology Co., Ltd SOCA Access Control System
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68601 CVE record

CVSS 5.4 Medium

WordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability
- Rustaurius Five Star Restaurant Reservations
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68584 CVE record

CVSS 4.3 Medium

WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- Constantin Boiangiu Vimeotheque
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68583 CVE record

CVSS 4.3 Medium

WordPress Fast User Switching plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability
- Tikweb Management Fast User Switching
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68580 CVE record

CVSS 4.3 Medium

WordPress Advanced Classifieds & Directory Pro plugin <= 3.2.9 - Cross Site Request Forgery (CSRF) vulnerability
- pluginsware Advanced Classifieds & Directory Pro
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68573 CVE record

CVSS 5.4 Medium

WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability
- Alessandro Piconi Simple Keyword to Link
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68567 CVE record

CVSS 5.4 Medium

WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability
- wphocus My auctions allegro
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-67625 CVE record

CVSS 4.3 Medium

WordPress Trade Runner plugin <= 3.14 - Cross Site Request Forgery (CSRF) vulnerability
- tmtraderunner Trade Runner
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-67622 CVE record

CVSS 7.1 High

WordPress Evergreen Post Tweeter plugin <= 1.8.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- titopandub Evergreen Post Tweeter
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2025-68529 CVE record

CVSS 4.3 Medium

WordPress WP Email Capture plugin <= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability
- Rhys Wynne WP Email Capture
- Cross-site request forgery (CSRF)
Not analysed yet 24 Dec 2025
CVE-2021-47722 CVE record

CVSS 5.1 Medium

Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery
- Axesstmc Zucchetti Axess CLOKI Access Control
- Cross-site request forgery (CSRF)
Not analysed yet 23 Dec 2025
CVE-2025-14163 CVE record

CVSS 4.3 Medium

Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'
- leap13 Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- Cross-site request forgery (CSRF)
Not analysed yet 23 Dec 2025
CVE-2023-53961 CVE record

CVSS 5.1 Medium

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery
- SOUND4 Ltd. Impact/Pulse/First
- SOUND4 Ltd. Impact/Pulse Eco
- Cross-site request forgery (CSRF)
Not analysed yet 22 Dec 2025
CVE-2025-62107 CVE record

CVSS 4.3 Medium

WordPress Feather Login Page plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability
- PluginOps Feather Login Page
- Cross-site request forgery (CSRF)
Not analysed yet 22 Dec 2025
CVE-2025-62880 CVE record

CVSS 4.3 Medium

WordPress Custom 404 Pro plugin <= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerability
- Kunal Custom 404 Pro
- Cross-site request forgery (CSRF)
Not analysed yet 22 Dec 2025
CVE-2025-13361 CVE record

CVSS 4.3 Medium

Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion
- dipesh_patel Web to SugarCRM Lead
- Cross-site request forgery (CSRF)
Not analysed yet 21 Dec 2025
CVE-2025-13365 CVE record

CVSS 6.1 Medium

WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting
- tikolan WP Hallo Welt
- Cross-site request forgery (CSRF)
Not analysed yet 20 Dec 2025
CVE-2025-14168 CVE record

CVSS 4.3 Medium

WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup
- wpmaniax WP DB Booster
- Cross-site request forgery (CSRF)
Not analysed yet 20 Dec 2025
CVE-2025-14734 CVE record

CVSS 5.4 Medium

Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
- nestornoe Amazon affiliate lite Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 20 Dec 2025
CVE-2025-14164 CVE record

CVSS 4.3 Medium

Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update
- edckwt Quran Gateway
- Cross-site request forgery (CSRF)
Not analysed yet 20 Dec 2025
fastapi-users PyPI

CVSS 5.9 Medium

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
- Broken access control
- Cross-site request forgery (CSRF)
<15.0.2 · fixed in 15.0.2

GHSA-5j53-63w8-8625 · CVE-2025-68481 Not analysed yet 19 Dec 2025
CVE-2025-1927 CVE record

CVSS 7.1 High

CSRF in Restajet's Online Food Delivery System
- Restajet Information Technologies Inc. Online Food Delivery System
- Cross-site request forgery (CSRF)
Not analysed yet 19 Dec 2025
CVE-2025-66906 CVE record

CVSS 6.1 Medium

Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.
- Cross-site request forgery (CSRF)
Not analysed yet 19 Dec 2025
CVE-2025-59949 CVE record

CVSS 5.3 Medium

FreshRSS has Logout CSRF that Leads to DoS via <track src>
- FreshRSS
- Cross-site request forgery (CSRF)
Not analysed yet 18 Dec 2025
CVE-2025-68434 CVE record

CVSS 8.8 High

opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation
- opensourcepos
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-14266 CVE record

CVSS 0.6 Low

CSRF in Ercom Cryptobox administration console
- Ercom Cryptobox
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-14399 CVE record

CVSS 4.3 Medium

Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival
- wpcodefactory Download Plugins and Themes in ZIP from Dashboard
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-64700 CVE record

CVSS 5.1 Medium

Cross-site request forgery in GROWI
- GROWI
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-67173 CVE record

CVSS 6.8 Medium

A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-66953 CVE record

CVSS 8.8 High

CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically the /system_setup.ht…
- Cross-site request forgery (CSRF)
Not analysed yet 17 Dec 2025
CVE-2025-65203 CVE record

CVSS 7.1 High

KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlle…
- Cross-site request forgery (CSRF)
- CWE-353
Not analysed yet 17 Dec 2025
CVE-2025-68083 CVE record

CVSS 5.4 Medium

WordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
- Meks Quick Plugin Disabler
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-68082 CVE record

CVSS 5.4 Medium

WordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability
- SEMrush CY LTD Semrush Content Toolkit
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-64240 CVE record

CVSS 4.3 Medium

WordPress Freshchat plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability
- Freshchat
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-64239 CVE record

CVSS 4.3 Medium

WordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability
- Yoav Farhi RTL Tester
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-64237 CVE record

CVSS 4.3 Medium

WordPress Quick Interest Slider plugin <= 3.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- Graham Quick Interest Slider
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025
CVE-2025-59009 CVE record

CVSS 4.3 Medium

WordPress Listify theme <= 3.2.5 - Cross Site Request Forgery (CSRF) vulnerability
- Astoundify Listify
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2025