CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-27415 MEDIUM
WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-41663 LOW
Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send
CVSS 3.5
CVE-2026-40326 HIGH
Masa CMS CSRF in site bundle creation allows unauthorized site data export
CVE-2026-40325 HIGH
Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content
CVE-2026-40309 HIGH
Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content
CVE-2026-40174 HIGH
Masa CMS CSRF in user address management allows unauthorized address changes
CVE-2026-8022 LOW
Google Chrome < 148.0.7778.96 - Cross-Origin Data Leak via MHTML
CVSS 3.1
CVE-2026-6702 MEDIUM
Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
CVSS 6.1
CVE-2026-6701 MEDIUM
addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
CVSS 4.3
CVE-2026-6700 MEDIUM
DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-42091 MEDIUM
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
CVSS 6.5
CVE-2026-3772 HIGH
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
CVSS 8.8
CVE-2026-3140 MEDIUM
Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
CVSS 4.3
CVE-2026-36960 HIGH
U-SPEED N300 Router 1.0.0 - Cross-Site Request Forgery in Web Management Interface
CVSS 8.8
CVE-2026-36956 HIGH
Dbit N300 T1 Pro Firmware V1.0.0 - Cross-Site Request Forgery via Web Management Interface
CVSS 8.8
CVE-2026-42645 MEDIUM
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.3
CVE-2026-38934 HIGH
diskoverdata diskover-community <=2.3.5 - CSRF
CVSS 8.8
CVE-2026-7108 MEDIUM
code-projects Invoice System in Laravel cross-site request forgery
CVSS 4.3
CVE-2026-41425 MEDIUM
Authlib: Cross-site request forging when using cache
CVSS 5.4
CVE-2026-3565 MEDIUM
Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
CVSS 4.3
CVE-2026-41317 HIGH
Frappe Press API Secret Generation - Cross-Site Request Forgery
CVSS 7.5
CVE-2026-27841 HIGH
SenseLive X3050 Cross-Site request forgery
CVSS 8.1
CVE-2026-41347 HIGH
OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints
CVSS 7.1
CVE-2026-40471 CRITICAL
Hackage CSRF vulnerability
CVSS 9.6
CVE-2026-4922 HIGH
Cross-Site Request Forgery (CSRF) in GitLab
CVSS 8.1
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits