CVE & Exploit Intelligence Database

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,223 CVEs tracked 53,280 with exploits 4,730 exploited in wild 1,542 CISA KEV 3,929 Nuclei templates 37,826 vendors 42,569 researchers

8,801 results Clear all

CVE-2025-52767 4.3 MEDIUM EPSS 0.00

NetInsight Analytics Implementation Plugin <1.0.4 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin allows Cross Site Request Forgery. This issue affects NetInsight Analytics Implementation Plugin: from n/a through 1.0.3.

CWE-352 Aug 14, 2025

CVE-2025-52765 7.1 HIGH EPSS 0.00

NetInsight Analytics Implementation Plugin <1.0.4 - CSRF/XSS

Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin allows Stored XSS. This issue affects NetInsight Analytics Implementation Plugin: from n/a through 1.0.3.

CWE-352 Aug 14, 2025

CVE-2024-53946 8.8 HIGH EPSS 0.00

KuWFi 4G LTE AC900 router 1.0.13 - CSRF

The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes.

CWE-352 Aug 14, 2025

CVE-2025-54703 4.3 MEDIUM EPSS 0.00

Prince Integrate Google Drive <1.5.2 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in Prince Integrate Google Drive allows Cross Site Request Forgery. This issue affects Integrate Google Drive: from n/a through 1.5.2.

CWE-352 Aug 14, 2025

CVE-2025-54702 4.3 MEDIUM EPSS 0.00

motov.net Ebook Store <5.8013 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store allows Cross Site Request Forgery. This issue affects Ebook Store: from n/a through 5.8013.

CWE-352 Aug 14, 2025

CVE-2025-54694 4.3 MEDIUM EPSS 0.00

bPlugins Button Block <1.2.0 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block allows Cross Site Request Forgery. This issue affects Button Block: from n/a through 1.2.0.

CWE-352 Aug 14, 2025

CVE-2025-54682 5.4 MEDIUM EPSS 0.00

CRM Perks Connector - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets allows Cross Site Request Forgery. This issue affects Connector for Gravity Forms and Google Sheets: from n/a through 1.2.4.

CWE-352 Aug 14, 2025

CVE-2025-54675 4.3 MEDIUM EPSS 0.00

YITHEMES YITH WooCommerce Popup <1.48.0 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup allows Cross Site Request Forgery. This issue affects YITH WooCommerce Popup: from n/a through 1.48.0.

CWE-352 Aug 14, 2025

CVE-2025-54674 5.4 MEDIUM EPSS 0.00

mklacroix Product Configurator for WooCommerce <1.4.4 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce allows Cross Site Request Forgery. This issue affects Product Configurator for WooCommerce: from n/a through 1.4.4.

CWE-352 Aug 14, 2025

CVE-2025-54673 4.3 MEDIUM EPSS 0.00

Ays Pro Chartify <3.5.3 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify allows Cross Site Request Forgery. This issue affects Chartify: from n/a through 3.5.3.

CWE-352 Aug 14, 2025

CVE-2025-54672 4.3 MEDIUM EPSS 0.00

Jordy Meow Photo Engine <6.4.3 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine allows Cross Site Request Forgery. This issue affects Photo Engine: from n/a through 6.4.3.

CWE-352 Aug 14, 2025

CVE-2025-54671 4.3 MEDIUM EPSS 0.00

Bobbingwide Oik <4.15.2 - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik allows Cross Site Request Forgery. This issue affects oik: from n/a through 4.15.2.

CWE-352 Aug 14, 2025

CVE-2025-49044 7.1 HIGH EPSS 0.00

tosend.it Simple Poll - CSRF

Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll allows Stored XSS. This issue affects Simple Poll: from n/a through 1.1.1.

CWE-352 Aug 14, 2025

CVE-2025-8891 4.3 MEDIUM EPSS 0.00

Oceanwp < 4.1.1 - CSRF

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE-352 Aug 13, 2025

CVE-2025-8491 4.3 MEDIUM EPSS 0.00

WordPress Easy restaurant menu manager <2.0.2 - CSRF

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE-352 Aug 13, 2025

CVE-2025-49555 8.1 HIGH EPSS 0.00

Adobe Commerce < 2.4.4 - CSRF

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed.

CWE-352 Aug 12, 2025

CVE-2025-7965 4.3 MEDIUM EPSS 0.00

CBX Restaurant Booking <1.2.1 - CSRF

The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CWE-352 Aug 11, 2025

CVE-2025-8814 4.3 MEDIUM 1 Writeup EPSS 0.00

Pybbs < 6.0.0 - Missing Authorization

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.

CWE-862 Aug 10, 2025

CVE-2025-8739 4.3 MEDIUM EPSS 0.00

Zhenfeng13 My-blog - Missing Authorization

A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CWE-862 Aug 08, 2025

CVE-2020-9322 8.8 HIGH EPSS 0.00

Statamic Core <2.11.8 - XSS

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.

CWE-352 Aug 08, 2025