Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

122 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-89119

    Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

    SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenti…

    SAP_SE SAP Web Dispatcher and Internet Communication Manager
  • Critical 10.0
    CVE-2026-73099

    Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

    Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver a…

    Apache Software Foundation Apache Juneau
  • Critical 9.4
    CVE-2026-97718

    CSRF in Secure Access Server v14.60

    CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server.  Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

    Absolute Security Secure Access
  • Critical 10.0
    CVE-2026-61826

    Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

    Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook co…

    morpheus65535 bazarr
  • Critical 9.6
    CVE-2026-116863

    WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

    Tribulant Software Newsletters
  • Critical 9.6
    CVE-2026-56662

    GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification.…

    GetSimpleCMS-CE GetSimpleCMS-CE
  • Critical 9.1
    CVE-2026-56660

    GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file…

    GetSimpleCMS-CE GetSimpleCMS-CE
  • Critical 10.0
    CVE-2025-15399

    Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the websit…

    IBM Common Licensing
  • Critical 9.4
    CVE-2026-52777

    YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

    YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

    YesWiki yeswiki yeswiki/yeswiki Packagist
  • Critical 9.6
    CVE-2026-53649

    Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

    Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-dat…

    BishopFox joro github.com/BishopFox/joro Go
  • Critical 9.6
    CVE-2026-28164

    WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

    HashThemes Easy Elementor Addons
  • Critical 9.3
    CVE-2026-67921 Public exploit

    Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java an…

  • Critical 9.6
    CVE-2026-46409

    OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

    OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin valida…

    openyak openyak
  • Critical 9.6
    CVE-2026-70376 Public exploit

    Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

    Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

    pluck-cms Pluck CMS
  • Critical 9.6
    CVE-2026-65471

    WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

    Avada Studio Avada Core
  • Critical 9.6
    CVE-2026-57784

    WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

    Ninja Forms Ninja Forms File Uploads Extension
  • Critical 9.0
    CVE-2026-61204

    Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (component: Primavera In…

    Oracle PeopleSoft Enterprise FIN Program Management
  • Critical 9.6
    CVE-2026-61097

    Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications …

    Oracle Oracle Banking Trade Finance Process Management
  • Critical 9.3
    CVE-2026-60631

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…

    Oracle Oracle WebCenter Content
  • Critical 9.1
    CVE-2026-26718 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an at…

  • Critical 9.1
    CVE-2026-15747

    Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

    Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field place…

    SRI Mojolicious libmojolicious-perl libmojolicious-perl Debian Ubuntu
  • Critical 9.6
    CVE-2026-55742

    Cotonti CSRF in admin.rights.php allows privilege escalation

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_g…

    cotonti cotonti cotonti/cotonti Packagist
  • Critical 9.6
    CVE-2026-46786

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…

    Oracle Oracle WebCenter Content
  • Critical 9.3
    CVE-2026-46785

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…

    Oracle Oracle WebCenter Content
  • Critical 9.8
    CVE-2019-25729

    PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie

    PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing te…

    simcy_creative PDF Signer
  • Critical 9.3
    CVE-2026-44364

    misp-modules website - Missing CSRF protection in the website home blueprint

    MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests…

    MISP misp-modules misp-modules PyPI
  • Critical 9.3
    CVE-2025-27851

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking atta…

  • Critical 9.6
    CVE-2026-40471

    Hackage CSRF vulnerability

    hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some un…

    hackage-server Hackage
  • Critical 9.6
    CVE-2026-39640

    WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.

    mndpsingh287 Theme Editor Web / CMS
  • Critical 9.6
    CVE-2026-39620

    WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.

    priyanshumittal Appointment
  • Critical 9.6
    CVE-2026-39619

    WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.

    priyanshumittal Busiprof
  • Critical 9.6
    CVE-2026-39617

    WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.

    priyanshumittal Bluestreet
  • Critical 9.7
    CVE-2026-28495

    GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php

    GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. …

    GetSimpleCMS-CE GetSimpleCMS-CE
  • Critical 9.3
    CVE-2026-30793

    RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

    Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with progr…

    rustdesk-client RustDesk Client
  • Critical 9.0
    CVE-2025-69634

    Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges…

  • Critical 9.3
    CVE-2026-25812

    PlaciPy is Missing CSRF Protection on State-Changing Endpoints

    PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

    Praskla-Technology assessment-placipy
  • Critical 9.6
    CVE-2025-52835

    WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.

    ConoHa by GMO WING WordPress Migrator Web / CMS
  • Critical 9.6
    CVE-2025-11022

    CSRF in Panilux

    Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.  This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was conta…

    Personal Project Panilux
  • Critical 9.6
    CVE-2024-45538

    Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-…

    Synology DiskStation Manager (DSM) Unified Controller (DSMUC)
  • Critical 9.4
    CVE-2025-62593 Exploited Public exploit EPSS 60%

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…

    ray-project ray ray PyPI
    KEV Aug 17, 2026