CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,336 vulnerabilities with CWE-352
CVE-2025-28876 MEDIUM
Skrill Official <= 1.0.66 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28868 MEDIUM
ZipList Recipe <= 3.1 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28867 MEDIUM
stesvis Frontpage category filter <= 1.0.2 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28866 MEDIUM
smerriman Login Logger <= 1.2.1 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28864 MEDIUM
Builder for Contact Form 7 by Webconstruct <= 1.2.2 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28863 MEDIUM
Delete Original Image < 0.4 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28862 MEDIUM
Venugopal Comment Date and Gravatar remover <= 1.0 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28861 HIGH
bhzad WP jQuery Persian Datepicker <= 0.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
CVSS 7.1
CVE-2025-28860 HIGH
Google News Editors Picks Feed Generator <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
CVSS 7.1
CVE-2025-28859 MEDIUM
CodeVibrant Maintenance Notice <= 1.0.6 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-28857 HIGH
rankchecker Rankchecker.io Integration <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
CVSS 7.1
CVE-2025-28856 MEDIUM
w3counter < 4.1 - Cross-Site Request Forgery
CVSS 4.3
CVE-2025-25928 HIGH
OpenMRS 2.4.3 - Cross-Site Request Forgery in User Form Endpoint
CVSS 8.0
CVE-2025-25927 MEDIUM
OpenMRS 2.4.3 Build 0ff0ed - Cross-Site Request Forgery via GET Request
CVSS 6.8
CVE-2025-25748 HIGH
HotelDruid 3.0.7 - Cross-Site Request Forgery in gestione_utenti.php
CVSS 7.3
CVE-2025-27912 HIGH
Datalust Seq < 2024.3.13545 - Cross-Site Request Forgery via Missing Content-Type Validation
CVSS 8.8
CVE-2025-27910 HIGH
tianti v2.3 - Cross-Site Request Forgery via /user/ajax/upd/status
CVSS 8.0
CVE-2025-25907 HIGH
tianti v2.3 - Cross-Site Request Forgery via /user/ajax/save
CVSS 8.8
CVE-2025-26910 HIGH
Iqonic Design WPBookit <= 1.0.1 - Cross-Site Request Forgery
CVSS 7.1
CVE-2025-24387 MEDIUM
OTRS 7.0.0-2025.1.1 - Session Hijacking via Sensitive Cookie with Missing SameSite Attribute
CVSS 4.8
CVE-2025-1926 MEDIUM
Page Builder: Pagelayer < 1.9.8 - Cross-Site Request Forgery via pagelayer_save_post Function
CVSS 4.3
CVE-2025-1382 MEDIUM
Contact Us By Lord Linus < 2.6 - Cross-Site Request Forgery and Stored Cross-Site Scripting
CVSS 6.1
CVE-2025-1362 MEDIUM
URL Shortener | Conversion Tracking | AB Testing | WooCommerce < 9.0.2 - Cross-Site Request Forgery in Bulk Actions
CVSS 4.3
CVE-2025-0748 MEDIUM
Homey < 2.4.3 - Cross-Site Request Forgery via homey_verify_user_manually Function
CVSS 4.3
CVE-2025-2042 MEDIUM
huang-yk student-manage 1.0 - Cross-Site Request Forgery
CVSS 4.3
Details
Vulnerabilities 9,336
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits