Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-4968 CVE record

CVSS 5.3 Medium

SourceCodester Diary App diary.php cross-site request forgery
- SourceCodester Diary App
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Mar 2026
CVE-2026-4984 CVE record

CVSS 8.2 High

Botpress - Credential Disclosure via Twilio Webhook Handler
- botpress
- Cross-site request forgery (CSRF)
- CWE-345
Not analysed yet 27 Mar 2026
CVE-2026-4393 CVE record

CVSS 4.3 Medium

Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030
- Drupal Automated Logout
- Cross-site request forgery (CSRF)
Not analysed yet 26 Mar 2026
CVE-2026-1032 CVE record

CVSS 4.3 Medium

Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update
- themifyme Conditional Menus
- Cross-site request forgery (CSRF)
Not analysed yet 26 Mar 2026
CVE-2025-36422 CVE record

CVSS 4.3 Medium

IBM InfoSphere Information Server is vulnerable to cross-site request forgery
- IBM InfoSphere Information Server
- Cross-site request forgery (CSRF)
Not analysed yet 25 Mar 2026
github.com/mattermost/mattermost/server/v8 Go

CVSS 4.6 Medium

Mattermost doesn't properly validate CSRF tokens
- Cross-site request forgery (CSRF)
>=8.0.0-20260105080200-d27a2195068d, <10.11.11 || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.2 || >=11.4.0-rc1, <11.4.1 · fixed in 10.11.11, 11.2.3, 11.3.2, 11.4.1

GHSA-rmhw-c3xr-m3xx · CVE-2026-27659 Not analysed yet 25 Mar 2026
wwbn/avideo Packagist

CVSS 8.1 High

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-g8x9-7mgh-7cvj · CVE-2026-33649 Not analysed yet 25 Mar 2026
CVE-2026-3857 CVE record

CVSS 8.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 25 Mar 2026
CVE-2026-3211 CVE record

CVSS 4.3 Medium

Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
- Drupal Theme Negotiation by Rules
- Cross-site request forgery (CSRF)
Not analysed yet 25 Mar 2026
CVE-2025-40841 CVE record

CVSS 5.1 Medium

Ericsson Indoor Connect 8855 - Cross-Site Request Forgery Vulnerability
- Ericsson Indoor Connect 8855
- Cross-site request forgery (CSRF)
Not analysed yet 25 Mar 2026
CVE-2026-29839 CVE record

CVSS 8.8 High

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
- Cross-site request forgery (CSRF)
Not analysed yet 24 Mar 2026
CVE-2026-4590 CVE record

CVSS 2.3 Low

kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery
- kalcaddle kodbox
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 23 Mar 2026
CVE-2026-31849 CVE record

CVSS 7.2 High

Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+
- Nexxt Solutions Nebula 300+
- Cross-site request forgery (CSRF)
Not analysed yet 23 Mar 2026
CVE-2026-2723 CVE record

CVSS 6.1 Medium

Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- phy9pas Post Snippits
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-4143 CVE record

CVSS 4.3 Medium

Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update
- neo2oo5 Neos Connector for Fakturama
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2025-14037 CVE record

CVSS 8.1 High

Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion
- Invelity Product Feeds
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-1503 CVE record

CVSS 4.3 Medium

login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- frankkoenen Plugin Name: login_register
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-3331 CVE record

CVSS 4.3 Medium

Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update
- chuckmo Lobot Slider Administrator
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-1392 CVE record

CVSS 4.3 Medium

SR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update
- superrishi SR WP Minify HTML
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-3332 CVE record

CVSS 4.3 Medium

Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
- xhanch_studio Xhanch – My Advanced Settings
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-1390 CVE record

CVSS 4.3 Medium

Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update
- haghs Redirect countdown
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-1378 CVE record

CVSS 4.3 Medium

WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update
- suifengtec WP Posts Re-order
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
CVE-2026-1393 CVE record

CVSS 4.3 Medium

Add Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update
- omarnas Add Google Social Profiles to Knowledge Graph Box
- Cross-site request forgery (CSRF)
Not analysed yet 21 Mar 2026
wwbn/avideo Packagist

CVSS 8.8 High

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
- Cross-site request forgery (CSRF)
<=26.0 · no fixed version yet

GHSA-hv36-p4w4-6vmj · CVE-2026-33507 Not analysed yet 20 Mar 2026
CVE-2026-32989 CVE record

CVSS 8.6 High

Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload
- Precurio Intranet Portal
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 20 Mar 2026
CVE-2024-32537 CVE record

CVSS 7.1 High

WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability
- joshuae1974 Flash Video Player
- Cross-site request forgery (CSRF)
Not analysed yet 20 Mar 2026
CVE-2026-33372 CVE record

CVSS 5.4 Medium

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.
- Cross-site request forgery (CSRF)
Not analysed yet 20 Mar 2026
github.com/modelcontextprotocol/go-sdk Go

CVSS 7.1 High

Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
- Cross-site request forgery (CSRF)
<1.4.1 · fixed in 1.4.1

GHSA-89xv-2j6f-qhc8 · CVE-2026-33252 Not analysed yet 19 Mar 2026
CVE-2026-4068 CVE record

CVSS 4.3 Medium

Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
- pattihis Add Custom Fields to Media
- Cross-site request forgery (CSRF)
Not analysed yet 19 Mar 2026
CVE-2026-22323 CVE record

CVSS 7.1 High

Cross‑Site Request Forgery in Link Aggregation Configuration
- Phoenix Contact FL SWITCH 2005
- Phoenix Contact FL SWITCH 2008
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55046 CVE record

CVSS 8.1 High

MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55045 CVE record

CVSS 7.1 High

The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55044 CVE record

CVSS 8.8 High

The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55043 CVE record

CVSS 6.5 Medium

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create…
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55041 CVE record

CVSS 8.0 High

MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any u…
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2025-55040 CVE record

CVSS 8.8 High

The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Mar 2026
CVE-2026-32839 CVE record

CVSS 5.1 Medium

Edimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints
- EDIMAX Technology Co., Ltd. Edimax GS-5008PL
- Cross-site request forgery (CSRF)
Not analysed yet 17 Mar 2026
next npm

CVSS 5.3 Medium

Next.js: null origin can bypass Server Actions CSRF checks
- Cross-site request forgery (CSRF)
>=16.0.1, <16.1.7 · fixed in 16.1.7

GHSA-mq59-m269-xvcx · CVE-2026-27978 Not analysed yet 17 Mar 2026
admidio/admidio Packagist

CVSS 5.7 Medium

Admidio is Missing CSRF Protection on Role Membership Date Changes
- Cross-site request forgery (CSRF)
<5.0.7 · fixed in 5.0.7

GHSA-h8gr-qwr6-m9gx · CVE-2026-32755 Not analysed yet 16 Mar 2026
admidio/admidio Packagist

CVSS 5.7 Medium

Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
- Cross-site request forgery (CSRF)
>=5.0.0, <5.0.7 · fixed in 5.0.7

GHSA-wwg8-6ffr-h4q2 · CVE-2026-32816 Not analysed yet 16 Mar 2026
CVE-2026-29521 CVE record

CVSS 5.1 Medium

Hereta ETH-IMC408M CSRF via Configuration Setup
- Shenzhen Hereta Technology Co., Ltd. Hereta ETH-IMC408M
- Cross-site request forgery (CSRF)
Not analysed yet 16 Mar 2026
CVE-2025-69238 CVE record

CVSS 6.9 Medium

Cross-Site Request Forgery in Raytha CMS
- Raytha
- Cross-site request forgery (CSRF)
Not analysed yet 16 Mar 2026
CVE-2017-20221 CVE record

CVSS 5.3 Medium

Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution
- Telesquare SDT-CS3B1
- Cross-site request forgery (CSRF)
Not analysed yet 16 Mar 2026
CVE-2016-20035 CVE record

CVSS 6.9 Medium

Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint
- Wowza Media Systems, LLC. Wowza Streaming Engine
- Cross-site request forgery (CSRF)
Not analysed yet 15 Mar 2026
CVE-2016-20034 CVE record

CVSS 8.7 High

Wowza Streaming Engine 4.5.0 Privilege Escalation via user edit
- Wowza Media Systems, LLC. Wowza Streaming Engine
- Cross-site request forgery (CSRF)
Not analysed yet 15 Mar 2026
CVE-2015-20117 CVE record

CVSS 6.9 Medium

RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation
- Next Click Ventures RealtyScript
- Cross-site request forgery (CSRF)
Not analysed yet 15 Mar 2026
CVE-2015-20113 CVE record

CVSS 6.9 Medium

RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities
- Next Click Ventuers RealtyScript
- Cross-site request forgery (CSRF)
Not analysed yet 15 Mar 2026
CVE-2016-20028 CVE record

CVSS 5.3 Medium

ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin
- ZKTeco Inc. ZKTeco ZKBioSecurity
- Cross-site request forgery (CSRF)
Not analysed yet 15 Mar 2026
CVE-2026-32456 CVE record

CVSS 4.3 Medium

WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability
- Janis Elsts Admin Menu Editor
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32443 CVE record

CVSS 6.5 Medium

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- Josh Kohlbach Product Feed PRO for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32420 CVE record

CVSS 5.4 Medium

WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- Ruben Garcia GamiPress
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32344 CVE record

CVSS 4.3 Medium

WordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability
- desertthemes Corpiva
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32343 CVE record

CVSS 4.3 Medium

WordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability
- Magazine3 Easy Table of Contents
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32342 CVE record

CVSS 4.3 Medium

WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- Ays Pro Quiz Maker
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32330 CVE record

CVSS 4.3 Medium

WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability
- Photo Gallery by 10Web
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-32328 CVE record

CVSS 5.4 Medium

WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability
- shufflehound Lemmony
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-22215 CVE record

CVSS 5.3 Medium

wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
- gVectors wpDiscuz
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-22202 CVE record

CVSS 6.1 Medium

wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
- gVectors wpDiscuz
- Cross-site request forgery (CSRF)
Not analysed yet 13 Mar 2026
CVE-2026-31954 CVE record

CVSS 0.0 None

Emlog asynchronous media file deletion missing CSRF protection
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 11 Mar 2026
CVE-2026-30868 CVE record

CVSS 6.3 Medium

Cross-Site Request Forgery (CSRF) in opnsense/core
- opnsense core
- Cross-site request forgery (CSRF)
Not analysed yet 11 Mar 2026