Cross-site request forgery (CSRF).

Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset

• alian Astro Booking Engine
• Cross-site request forgery (CSRF)

francoisjacquet RosarioSIS Modules.php cross-site request forgery

• francoisjacquet RosarioSIS
• Cross-site request forgery (CSRF)
• Broken access control

IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

• i
• Cross-site request forgery (CSRF)

IBM Planning Analytics Local is affected by security vulnerabilities

• IBM Planning Analytics
• Cross-site request forgery (CSRF)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

• Elastic Kibana
• Cross-site request forgery (CSRF)

phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

• phplist3
• Cross-site request forgery (CSRF)

phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

• phplist3
• Cross-site request forgery (CSRF)

Cross-site request forgery in Zimbra Collaboration

• Zimbra Collaboration
• Cross-site request forgery (CSRF)

HCL AION is affected by multiple security vulnerabilities.

• HCL Software AION
• Cross-site request forgery (CSRF)

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

• ShopEngine Elementor WooCommerce Builder Addon
• Cross-site request forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers.

• Cross-site request forgery (CSRF)

Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

• Nagios Enterprises, LLC. Nagios Core
• Nagios Enterprises, LLC. Nagios XI
• Cross-site request forgery (CSRF)

cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

• MISP cti-transmute
• Cross-site request forgery (CSRF)

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• Cross-site request forgery (CSRF)

PingFederate Administrative Console CSRF weaknesses

• Ping Identity PingFederate
• Cross-site request forgery (CSRF)

FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher

• FreePBX Framework
• Cross-site request forgery (CSRF)

WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability

• WP Umbrella
• Cross-site request forgery (CSRF)

Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

• Advanced Classifieds & Directory Pro
• Information disclosure
• Cross-site request forgery (CSRF)

Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status

• Solace Extra
• Cross-site request forgery (CSRF)
• Broken access control

OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

• openyak
• Code injection
• Authentication bypass

Estatik < 4.3.3 - Login CSRF

• Estatik Real Estate Plugin
• Cross-site request forgery (CSRF)

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

• Vladimir Garagulya Plugins Garbage Collector (Database Cleanup)
• Cross-site request forgery (CSRF)

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

• Jeff Farthing Theme My Login
• Cross-site request forgery (CSRF)

WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

• Data443 Risk Mitigation, Inc. Tracking Code Manager
• Cross-site request forgery (CSRF)

Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration

• Hubzilla
• Cross-site request forgery (CSRF)

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site request forgery (CSRF)

Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF

• Google Authenticator
• Cross-site request forgery (CSRF)

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

• PeproDev WooCommerce Receipt Uploader
• Cross-site request forgery (CSRF)
• Broken access control

Livebook Teams identity callback lacks state binding, allowing login CSRF

• Cross-site request forgery (CSRF)

>=0.15.0, <0.18.7 || >=0.19.0, <0.19.9 · fixed in 0.18.7, 0.19.9

Cross-site request forgery in Jenkins Project Jenkins SCM-Manager Plugin

• Jenkins Project Jenkins SCM-Manager Plugin
• Cross-site request forgery (CSRF)

Cross-site request forgery in Jenkins Project Jenkins Multijob Plugin

• Jenkins Project Jenkins Multijob Plugin
• Cross-site request forgery (CSRF)

Cross-site request forgery in Progress MarkLogic Server Admin UI

• Progress Software Corporation MarkLogic Server
• Cross-site request forgery (CSRF)

OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

• openshwprojects OpenBK7231T_App
• Cross-site request forgery (CSRF)

Cross-site request forgery in Eclipse Foundation Eclipse Theia

• Eclipse Foundation Eclipse Theia
• Path traversal
• Authentication bypass

Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

• pluck-cms Pluck CMS
• Cross-site request forgery (CSRF)

Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery

• cornelraiu-1 Search Analytics for WP
• Cross-site request forgery (CSRF)

MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

• MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings
• Information disclosure
• Cross-site request forgery (CSRF)

GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF

• GDPR Cookie Compliance
• Cross-site request forgery (CSRF)

RackTables cross-site request forgery

• RackTables
• Cross-site request forgery (CSRF)
• Broken access control

Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

• Cross-site request forgery (CSRF)

>=0.2.0-beta.1, <0.5.0 · fixed in 0.5.0

Admidio before 5.0.11 CSRF via category-report preferences

• admidio
• Cross-site request forgery (CSRF)

Cross-Site Request Forgery in the Administrative User Deletion Endpoint

• misp cti-transmute
• Cross-site request forgery (CSRF)

Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

• Frontend File Manager Plugin
• Cross-site request forgery (CSRF)

Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset

• Lenxel WP
• Authentication bypass
• Cross-site request forgery (CSRF)

AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

• tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
• Cross-site request forgery (CSRF)

Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

• mndpsingh287 Theme Editor
• Cross-site request forgery (CSRF)

Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

• Podlove Podcast Publisher
• Cross-site request forgery (CSRF)

CSRF in PHP Jabbers scripts

• PHP Jabbers Appointment Scheduler
• PHP Jabbers Bus Reservation System
• Cross-site request forgery (CSRF)

PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF).

• Cross-site request forgery (CSRF)

Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

• Leantime
• Cross-site request forgery (CSRF)

Apache JSPWiki: JSPWiki vulnerable to JSON hijacking

• Apache Software Foundation Apache JSPWiki
• Cross-site request forgery (CSRF)

Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

• Apache Software Foundation Apache Zeppelin
• Cross-site request forgery (CSRF)

CSRF in Softtr's E-Commerce Pack

• Softtr Information Technology Trade Ltd. Co. E-Commerce Pack
• Cross-site request forgery (CSRF)

FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle

• FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
• Cross-site request forgery (CSRF)

Tourmaster < 5.4.8 - Stored XSS via CSRF

• tourmaster
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)

Cross-site request forgery in Google Chrome

• Google Chrome
• Cross-site request forgery (CSRF)
• CWE-693

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

• IBM WebSphere Application Server - Liberty
• Cross-site request forgery (CSRF)

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

• balbooa.com Gridbox extension for Joomla
• Cross-site request forgery (CSRF)

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

• rolandd.com RO CSVI extension for Joomla
• Cross-site request forgery (CSRF)

Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update

• facturadorvirtual Facturación Electrónica Costa Rica
• Cross-site request forgery (CSRF)