CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-28761 HIGH
Fujitsu Japan Limited Musetheque V4 Information Disclosure For Ipknowledge - Cross-Site Request Forgery (CSRF)
CVSS 8.1
CVE-2026-5365 MEDIUM
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
CVSS 4.3
CVE-2026-4527 MEDIUM
Cross-Site Request Forgery (CSRF) in GitLab
CVSS 6.5
CVE-2026-44364 CRITICAL
misp-modules website - Missing CSRF protection in the website home blueprint
CVE-2026-41255 MEDIUM
CKAN: CSRF exemption primed by anonymous requests
CVSS 6.1
CVE-2026-40703 MEDIUM
BIG-IP 16.1.0-17.1.3.1 17.5.0-17.5.1.4 >=21.0.0 - Cross-Site Request Forgery in Dashboard
CVSS 5.4
CVE-2026-44548 HIGH
ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
CVSS 8.1
CVE-2026-44347 MEDIUM
Warpgate: SSO CSRF -- State Token Not Validated on Return
CVSS 5.8
CVE-2026-42289 HIGH
ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
CVSS 8.8
CVE-2026-30807 HIGH
Pandora FMS 777-800 - Cross-Site Request Forgery
CVSS 8.8
CVE-2026-7616 MEDIUM
Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter
CVSS 4.3
CVE-2026-7562 MEDIUM
WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-7561 MEDIUM
Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
CVSS 6.1
CVE-2026-6932 MEDIUM
Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form
CVSS 4.3
CVE-2026-6710 MEDIUM
Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form
CVSS 4.3
CVE-2026-45430 HIGH
Backdrop CMS Contributed Projects Backdrop-contrib/salesforce < 1.x-1.0.1 - Cross-Site Request Forgery (CSRF)
CVSS 7.1
CVE-2026-0502 MEDIUM
Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform
CVSS 5.4
CVE-2026-44695 MEDIUM
Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity
CVSS 5.8
CVE-2026-43877 MEDIUM
WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes
CVSS 5.4
CVE-2026-38566 HIGH
HireFlow 1.2 - Cross-Site Request Forgery via Unprotected POST Endpoints
CVSS 8.1
CVE-2026-8194 MEDIUM
osTicket Dispatcher class.dispatcher.php cross-site request forgery
CVSS 4.3
CVE-2026-42286 HIGH
Emlog: Cross-Site Request Forgery in Admin Functions
CVE-2026-42190 MEDIUM
RedwoodSDK: Same-site CSRF in in server actions
CVSS 5.3
CVE-2026-5791 MEDIUM
CSRF in DivvyDrive Information Technologies' DivvyDrive
CVSS 6.5
CVE-2026-28201 HIGH
SurrealDB Injection on Open Notebook
CVSS 7.8
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits