Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Architecture and Design

Do not use the GET method for any request that triggers a state change.
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

High 8.8

CVE-2026-107084 Public exploit

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/module…

Oct 19, 2026
High 8.8

CVE-2026-96838 Public exploit

WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions.

YoOhw Studio Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification Web / CMS

Sep 30, 2026
High 8.8

CVE-2026-62062 Public exploit

WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

Elementor Elementor Website Builder

Sep 25, 2026
High 7.1

CVE-2026-19650 Public exploit

Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via G…

GitLab GitLab Web / CMS

Aug 17, 2026
High 8.3

CVE-2026-73292 Public exploit

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…

semaphoreui semaphore github.com/semaphoreui/semaphore Go

Aug 12, 2026
High 7.1

CVE-2026-65540 Public exploit

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

Metin Saraç Popup for CF7 with Sweet Alert

Jul 23, 2026
High 7.5

CVE-2026-52100 Public exploit

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to …

Jul 14, 2026
High 8.1

CVE-2026-43735 Public exploit

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers

Jun 29, 2026
High 8.8

CVE-2026-42559 Public exploit

RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publ…

modelcontextprotocol rust-sdk rmcp dynoxide-rs npm crates.io

May 14, 2026
High 8.8

CVE-2026-36960 Public exploit

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1…

Apr 30, 2026
High 8.8

CVE-2026-36956 Public exploit

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wirele…

Apr 30, 2026
High 8.8

CVE-2026-38934 Public exploit

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacke…

Apr 27, 2026
High 8.1

CVE-2026-39371 Public exploit

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site …

redwoodjs sdk rwsdk npm

Apr 7, 2026
High 8.8

CVE-2025-68722 Public exploit

Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability …

Feb 5, 2026
High 8.8

CVE-2025-68434 Public exploit

opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's …

opensourcepos opensourcepos

Dec 17, 2025
High 7.6

CVE-2025-65027 Public exploit

RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files…

rommapp romm

Dec 3, 2025
High 8.8

CVE-2025-57310 Public exploit

A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to adm…

Nov 12, 2025
High 8.8

CVE-2025-12028 Public exploit

IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?actio…

indieweb IndieAuth Web / CMS

Oct 24, 2025
High 8.2

CVE-2025-59845 Public exploit

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. Th…

apollographql embeddable-explorer @apollo/sandbox @apollo/explorer npm

Sep 26, 2025
High 8.1

CVE-2025-47533 Public exploit

WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.

Iqonic Design Graphina

May 7, 2025
High 8.1

CVE-2025-28062 Public exploit

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allo…

May 5, 2025
High 8.8

CVE-2024-11142 Public exploit

CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05.

Gosoft Software Proticaret E-Commerce

May 2, 2025
High 7.3

CVE-2025-25748 Public exploit

A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized a…

hoteldruid hoteldruid Debian Ubuntu

Mar 11, 2025
High 8.8

CVE-2025-1306 Public exploit

Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible f…

spicethemes Newscrunch Web / CMS

Mar 4, 2025
High 7.1

CVE-2025-26543 Public exploit

WordPress Simple Responsive Menu plugin <= 2.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through <= 2.1.

Pukhraj Suthar Simple Responsive Menu

Feb 13, 2025
High 8.8

CVE-2024-56901 Public exploit

A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less th…

Feb 3, 2025
High 8.1

CVE-2024-57373 Public exploit

Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized…

Jan 27, 2025
High 7.3

CVE-2024-56924 Public exploit

A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers t…

Jan 22, 2025
High 7.1

CVE-2025-24001 Public exploit

WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.

Ngô Thắng IT PPO Call To Actions

Jan 21, 2025
High 8.8

CVE-2024-50858 Public exploit

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute acti…

Jan 14, 2025
High 7.5

CVE-2025-22963 Public exploit

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

Sismics Teedy

Jan 13, 2025
High 8.8

CVE-2024-56116 Public exploit

A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator…

Dec 18, 2024
High 7.1

CVE-2024-48846 Public exploit

Cross Side Request Forgery, CSRF

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT

Dec 5, 2024
High 7.6

CVE-2024-52002 Public exploit

Cross-Site Request Forgery (CSRF) in several iTop pages

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and a…

Combodo iTop

Nov 8, 2024
High 8.0

CVE-2024-45264 Public exploit

A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remot…

Aug 27, 2024
High 7.5

CVE-2024-40815 Public exploit

A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonom…

Apple macOS iOS and iPadOS watchOS macOS iOS

Jul 29, 2024
High 8.8

CVE-2024-40119 Public exploit

Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery …

Jul 17, 2024
High 7.5

CVE-2024-34069 Public exploit

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

pallets werkzeug werkzeug python-werkzeug Debian Ubuntu PyPI

May 6, 2024
High 8.8

CVE-2024-27474 Public exploit

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perfor…

Apr 10, 2024
High 8.8

CVE-2024-22939 Public exploit

Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the sys…

Feb 1, 2024