Total
9704 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-20102 | 1 Machform | 1 Machform | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place. | |||||
| CVE-2021-20096 | 1 Lucyparsonslabs | 1 Openoversight | 2026-06-17 | 5.8 MEDIUM | 8.1 HIGH |
| Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. | |||||
| CVE-2021-20073 | 1 Racom | 2 M\!dge, M\!dge Firmware | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. | |||||
| CVE-2021-1257 | 5 Apple, Cisco, Linux and 2 more | 5 Macos, Catalyst Center, Linux Kernel and 2 more | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a web-based management user to follow a specially crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the authenticated user. These actions include modifying the device configuration, disconnecting the user's session, and executing Command Runner commands. | |||||
| CVE-2021-1227 | 1 Cisco | 46 Mds 9148s, Mds 9250i, Mds 9706 and 43 more | 2026-06-17 | 5.8 MEDIUM | 8.1 HIGH |
| A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default. | |||||
| CVE-2020-9454 | 1 Metagauss | 1 Registrationmagic | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms. | |||||
| CVE-2020-9394 | 1 Supsystic | 1 Pricing Table By Supsystic | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. | |||||
| CVE-2020-9388 | 1 Squaredup | 1 Squaredup | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard. | |||||
| CVE-2020-9346 | 1 Zohocorp | 1 Manageengine Password Manager Pro | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role. | |||||
| CVE-2020-9341 | 1 Auieo | 1 Candidats | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. | |||||
| CVE-2020-9322 | 2026-06-17 | N/A | 8.8 HIGH | ||
| The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO. | |||||
| CVE-2020-9271 | 1 Icehrm | 1 Icehrm | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. | |||||
| CVE-2020-9270 | 1 Icehrm | 1 Icehrm | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. | |||||
| CVE-2020-9267 | 1 Soplanning | 1 Soplanning | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. | |||||
| CVE-2020-9266 | 1 Soplanning | 1 Soplanning | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. | |||||
| CVE-2020-9042 | 1 Couchbase | 1 Couchbase Server | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. | |||||
| CVE-2020-9018 | 1 Litecart | 1 Litecart | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user. | |||||
| CVE-2020-8985 | 1 Zend | 1 Zendto | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality. | |||||
| CVE-2020-8976 | 1 Zigor | 2 Zgr Tps200 Ng, Zgr Tps200 Ng Firmware | 2026-06-17 | N/A | 9.6 CRITICAL |
| The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request. | |||||
| CVE-2020-8830 | 1 Commscope | 2 Ruckus Zoneflex R500, Ruckus Zoneflex R500 Firmware | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen. | |||||