CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-32816 MEDIUM
Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
CVSS 5.7
CVE-2026-32755 MEDIUM
Admidio is Missing CSRF Protection on Role Membership Date Changes
CVSS 5.7
CVE-2026-4068 MEDIUM
Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
CVSS 4.3
CVE-2026-22323 HIGH
Cross‑Site Request Forgery in Link Aggregation Configuration
CVSS 7.1
CVE-2026-27978 MEDIUM
Next.js: null origin can bypass Server Actions CSRF checks
CVSS 4.3
CVE-2026-32839 MEDIUM
Edimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints
CVSS 4.3
CVE-2026-29521 MEDIUM
Hereta ETH-IMC408M CSRF via Configuration Setup
CVSS 4.3
CVE-2026-32456 MEDIUM
Admin Menu Editor <= 1.14.1 - Cross-Site Request Forgery
CVSS 4.3
CVE-2026-32443 MEDIUM
Product Feed PRO for WooCommerce <=13.5.2 - CSRF
CVSS 6.5
CVE-2026-32420 MEDIUM
GamiPress <= 7.6.6 - Cross-Site Request Forgery
CVSS 5.4
CVE-2026-32344 MEDIUM
Corpiva <= 1.0.96 - Cross-Site Request Forgery
CVSS 4.3
CVE-2026-32343 MEDIUM
Magazine3 Easy Table of Contents <=2.0.80 - CSRF
CVSS 4.3
CVE-2026-32342 MEDIUM
Ays Pro Quiz Maker <=6.7.1.2 - CSRF
CVSS 4.3
CVE-2026-32330 MEDIUM
10Web Photo Gallery <=1.8.37 - CSRF
CVSS 4.3
CVE-2026-32328 MEDIUM
Lemmony < 1.7.1 - Cross-Site Request Forgery
CVSS 5.4
CVE-2026-22215 MEDIUM
wpDiscuz < 7.6.47 - Cross-Site Request Forgery in getFollowsPage Function
CVSS 4.3
CVE-2026-22202 HIGH
wpDiscuz < 7.6.47 - Cross-Site Request Forgery via Destructive GET Action
CVSS 8.1
CVE-2026-31954 NONE
emlog < 2.6.6 - Cross-Site Request Forgery via Asynchronous Delete Action
CVE-2026-30868 MEDIUM
OPNsense < 26.1.4 - Authenticated Cross-Site Request Forgery via MVC API GET Endpoints
CVSS 6.3
CVE-2026-3903 MEDIUM
Modular DS WordPress Plugin <2.5.1 - CSRF
CVSS 4.3
CVE-2026-2626 HIGH
Divi-Booster <5.0.2 - CSRF & Object Injection
CVSS 8.1
CVE-2026-2324 MEDIUM
LatePoint Calendar Booking Plugin <5.2.7 - CSRF
CVSS 6.1
CVE-2026-29113 MEDIUM
Craft CMS 4.0.0-4.17.3 - Cross-Site Request Forgery via Preview Token Endpoint
CVSS 4.3
CVE-2026-28495 CRITICAL
GetSimple CMS < 3.3.22 - Unauthenticated Remote Code Execution via CSRF in gsconfig Editor
CVSS 9.6
CVE-2026-28281 HIGH
InstantCMS < 2.18.1 - Cross-Site Request Forgery
CVSS 7.1
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits