CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-22342 HIGH
WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability
CVSS 8.8
CVE-2026-46955 HIGH
Oracle Human Resources 12.2.3-12.2.15 - Unauthenticated Remote Code Execution via HTTP
CVSS 7.5
CVE-2026-46894 HIGH
Oracle iSupplier Portal 12.2.3-12.2.15 - Authenticated Remote Code Execution via Home Page
CVSS 8.0
CVE-2026-46869 MEDIUM
MySQL Shell 8.4.0-8.4.9 and 9.0.0-9.7.0 - Unauthenticated Unauthorized Data Access via Dump and Load
CVSS 6.5
CVE-2026-46787 HIGH
Oracle WebCenter Content 14.1.2.0.0 - Unauthenticated Data Manipulation and Access via HTTP
CVSS 8.0
CVE-2026-46786 CRITICAL
Oracle WebCenter Content 14.1.2.0.0 - Unauthenticated Remote Code Execution via HTTP
CVSS 9.6
CVE-2026-46785 CRITICAL
Oracle WebCenter Content 14.1.2.0.0 - Unauthenticated Data Manipulation and Access via HTTP
CVSS 9.3
CVE-2026-49043 MEDIUM
WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability
CVSS 4.7
CVE-2026-48518 MEDIUM
MultiJuicer: Login CSRF allows attacker to force victims into their team
CVSS 4.3
CVE-2026-49396 HIGH
Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents
CVSS 7.1
CVE-2026-54359 HIGH
MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
CVE-2026-48612 HIGH
phpBB < 3.3.16 - Cross-Site Request Forgery (CSRF)
CVSS 8.0
CVE-2026-53739 MEDIUM
Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice
CVSS 4.3
CVE-2026-53736 MEDIUM
Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action
CVSS 4.3
CVE-2026-39170 MEDIUM
SemCms 5.0 - Cross-Site Request Forgery via /admin/semcms_user.php
CVSS 6.3
CVE-2026-8940 MEDIUM
WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update
CVSS 4.3
CVE-2026-8910 MEDIUM
WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
CVSS 6.1
CVE-2026-8909 MEDIUM
WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
CVSS 4.3
CVE-2026-8907 MEDIUM
WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
CVSS 6.1
CVE-2026-8904 MEDIUM
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save
CVSS 4.3
CVE-2026-8902 MEDIUM
AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-10553 MEDIUM
jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update
CVSS 4.3
CVE-2026-9719 MEDIUM
LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
CVSS 4.3
CVE-2026-7047 MEDIUM
Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action
CVSS 4.3
CVE-2026-11270 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Crafted HTML Page
CVSS 6.5
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits