Advisories · Weakness
Cross-site request forgery (CSRF).
A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
- KNIME Business Hub
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability
- Xpro Elementor Addons
- Cross-site request forgery (CSRF)
- CVSS 8.6 High
Obot before 0.26.0 API Key Theft via CLI Login Token Request
- obot
- Cross-site request forgery (CSRF)
- CVSS 3.7 Low
Cross-site request forgery in Roundcube Webmail
- Roundcube Webmail
- Cross-site request forgery (CSRF)
- CVSS 4.2 Medium
Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
- Drupal Project Browser
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
- Drupal Tawk.to - Live chat application
- Cross-site request forgery (CSRF)
- CVSS 4.2 Medium
Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise
- Splunk Enterprise
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- Tailored Media Tailored Tools
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Cross-Site Request Forgery (CSRF) in hMailServer
- Progressive Robot Ltd hMailServer
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Download Manager (Free & Pro) - Privacy Settings Update via CSRF
- Download Manager
- Cross-site request forgery (CSRF)
- CVSS 7.5 High
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
- Uncanny Toolkit for LearnDash
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
- WWBN AVideo
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Cross-site request forgery in Oracle Corporation Oracle BI Publisher
- Oracle Corporation Oracle BI Publisher
- Cross-site request forgery (CSRF)
- CVSS 3.1 Low
Cross-site request forgery in Oracle Corporation Siebel CRM End User
- Oracle Corporation Siebel CRM End User
- Cross-site request forgery (CSRF)
- CVSS 3.1 Low
Cross-site request forgery in Oracle Corporation JD Edwards EnterpriseOne Tools
- Oracle Corporation JD Edwards EnterpriseOne Tools
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Cross-site request forgery in Oracle Corporation Oracle WebCenter Portal
- Oracle Corporation Oracle WebCenter Portal
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Cross-site request forgery in Oracle Corporation Oracle Applications Framework
- Oracle Corporation Oracle Applications Framework
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Cross-site request forgery in Oracle Corporation Siebel CRM Development
- Oracle Corporation Siebel CRM Development
- Cross-site request forgery (CSRF)
- CVSS 4.7 Medium
Improper access control in Oracle Corporation Siebel CRM Integration
- Oracle Corporation Siebel CRM Integration
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Cross-site request forgery in Oracle Corporation Siebel Life Sciences
- Oracle Corporation Siebel Life Sciences
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Cross-site request forgery in Oracle Corporation Siebel CRM Development
- Oracle Corporation Siebel CRM Development
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Cross-site request forgery in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
- e4jvikwp VikRentCar
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
- Apache Software Foundation Apache Airflow Amazon provider
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset
- locust
- Cross-site request forgery (CSRF)
- CVSS 4.2 Medium
@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
- @fastify/oauth2
- Cross-site request forgery (CSRF)
- Authentication bypass
- CVSS 6.1 Medium
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
- Apache Software Foundation Apache Camel
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
- aircheng-org iWebShop-5
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 8.8 High
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter…
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Gitea cross-site request forgery on repository topics
- Gitea
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Gitea OpenID account linking without session binding
- Gitea
- Authentication bypass
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
dyad-sh dyad OAuth Callback cross-site request forgery
- dyad
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 2.3 Low
Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
- gitify
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
- thorsten phpMyFAQ
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
- thorsten phpMyFAQ
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
- Patreon WordPress
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
- wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
- tinyhumansai openhuman
- Cross-site request forgery (CSRF)
- Authentication bypass
- CVSS 8.8 High
WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- aThemeArt Theme Helper
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
- Salon Booking System
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- Authentication bypass
- Cross-site request forgery (CSRF)
<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0
GHSA-44xr-mrhh-qm78 · CVE-2026-84312 - CVSS 6.5 Medium
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
- Cross-site request forgery (CSRF)
<5.0.2 · fixed in 5.0.2
GHSA-526j-582w-7fm9 · CVE-2026-62322 - CVSS 8.8 High
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Active Directory Password Change CSRF in AuthTake Technology's authtake
- authtake
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGrill User Registration
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
FileRise: Missing CSRF enforcement for file creation and share-link creation
- error311 FileRise
- Cross-site request forgery (CSRF)
- CVSS 6.0 Medium
Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
- mher flower
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
- C4illin ConvertX
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability
- Patreon WordPress
- Cross-site request forgery (CSRF)
- CVSS 7.4 High
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
- Patreon WordPress
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Netcore NR268 CGI Endpoint cross-site request forgery
- Netcore NR268
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 7.5 High
Cross-site request forgery in Progress MarkLogic Server Query Console
- Progress Software Corporation MarkLogic Server
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Cross-Site Request Forgery in Administrative Actions
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Cross-Site Request Forgery in Import/Export Admin console
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
- Hotel Booking
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
yangzongzhuan RuoYi cross-site request forgery
- yangzongzhuan RuoYi
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 2.3 Low
Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback
- Traccar
- Cross-site request forgery (CSRF)