Total
9688 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-4275 | 2026-07-09 | N/A | 8.8 HIGH | ||
| The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress. | |||||
| CVE-2026-58518 | 1 Mediawiki | 1 Mediawiki | 2026-07-09 | N/A | 6.3 MEDIUM |
| Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3. | |||||
| CVE-2026-5923 | 2026-07-09 | N/A | N/A | ||
| Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage. | |||||
| CVE-2024-41597 | 1 Processwire | 1 Processwire | 2026-07-09 | N/A | 4.2 MEDIUM |
| Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review. | |||||
| CVE-2023-47326 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 8.8 HIGH |
| Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. | |||||
| CVE-2023-47322 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 8.8 HIGH |
| The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application. | |||||
| CVE-2023-45992 | 1 Commscope | 1 Ruckus Cloudpath Enrollment System | 2026-07-09 | N/A | 9.6 CRITICAL |
| A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system. | |||||
| CVE-2023-43278 | 1 Seacms | 1 Seacms | 2026-07-09 | N/A | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. | |||||
| CVE-2023-41452 | 1 Phpkobo | 1 Ajaxnewsticker | 2026-07-09 | N/A | 8.8 HIGH |
| Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component. | |||||
| CVE-2023-39061 | 1 Chamilo | 1 Chamilo | 2026-07-09 | N/A | 3.5 LOW |
| Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. | |||||
| CVE-2022-43340 | 1 Dzzoffice | 1 Dzzoffice | 2026-07-09 | N/A | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users. | |||||
| CVE-2022-40488 | 1 Processwire | 1 Processwire | 2026-07-09 | N/A | 6.5 MEDIUM |
| ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF). | |||||
| CVE-2022-30014 | 1 Simple Food Website Project | 1 Simple Food Website | 2026-07-09 | 6.8 MEDIUM | 8.8 HIGH |
| Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account. | |||||
| CVE-2022-26173 | 1 Jforum | 1 Jforum | 2026-07-09 | 6.8 MEDIUM | 8.8 HIGH |
| JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts. | |||||
| CVE-2022-25523 | 1 Typesettercms | 1 Typesetter | 2026-07-09 | 6.8 MEDIUM | 8.8 HIGH |
| TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request. | |||||
| CVE-2022-23349 | 1 Bigantsoft | 1 Bigant Server | 2026-07-09 | 6.8 MEDIUM | 8.8 HIGH |
| BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). | |||||
| CVE-2021-31659 | 1 Tp-link | 4 Tl-sg2005, Tl-sg2005 Firmware, Tl-sg2008 and 1 more | 2026-07-09 | 6.8 MEDIUM | 8.8 HIGH |
| TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with. | |||||
| CVE-2021-26216 | 1 Seeddms | 1 Seeddms | 2026-07-09 | 4.3 MEDIUM | 4.3 MEDIUM |
| SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. | |||||
| CVE-2021-26215 | 1 Seeddms | 1 Seeddms | 2026-07-09 | 4.3 MEDIUM | 4.3 MEDIUM |
| SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. | |||||
| CVE-2020-35273 | 1 Egavilanmedia | 1 User Registration \& Login System With Admin Panel | 2026-07-09 | 6.0 MEDIUM | 8.0 HIGH |
| EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account. | |||||