Weakness (CWE)
CWE-352: Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
How to prevent it (7 mitigations)
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
-
Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
-
Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
-
Architecture and Design
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
-
Architecture and Design
Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
-
Architecture and Design
Do not use the GET method for any request that triggers a state change.
-
Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
Source: MITRE CWE-352
4,153 results · Clear filters · Feed
-
Medium 6.5
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.
-
Medium 4.6
Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's cr…
-
Medium 6.5
WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.
-
Medium 6.3
WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.
-
Medium 5.4CVE-2026-122675 Public exploit
WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.
-
Medium 4.3
WP Google Review Slider < 18.11 - Google API Settings Update via CSRF
The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site ad…
-
Medium 4.3
Presenton User Configuration user-config JSON.parse cross-site request forgery
A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to l…
-
Medium 4.3
nliautaud pico-content-editor cross-site request forgery
A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The …
-
Medium 6.5
vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-ch…
-
Medium 5.4
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged int…
-
Medium 5.3
Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Co…
-
Medium 6.8
MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-…
-
Medium 6.5
Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attac…
-
Medium 5.9
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprot…
-
Medium 6.8
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token (via network sniffing, log files, …
-
Medium 5.4
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
-
Medium 6.5
Chamilo LMS: CSRF in destructive skill-management AJAX actions
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token…
-
Medium 4.3
FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_l…
-
Medium 5.3
Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
-
Medium 4.8
Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
-
Medium 5.3
Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
-
Medium 6.5CVE-2026-118570 Public exploit
Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
-
Medium 4.3
WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.
-
Medium 4.8
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
-
Medium 4.3
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights …
-
Medium 4.3
Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy …
-
Medium 5.4
Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notificatio…
-
Medium 5.3
Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection r…
-
Medium 6.5
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in …
-
Medium 6.5
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on th…
-
Medium 5.4
REDAXO before 5.21.3 CSRF in Article History Plugin
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering…
-
Medium 5.4
REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable…
-
Medium 5.3
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
-
Medium 5.1
Cross-Site Request Forgery (CSRF) in boneIO
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on t…
-
Medium 6.5
Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Phot…
-
Medium 4.3
WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
-
Medium 4.3
LinkStackOrg LinkStack cross-site request forgery
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted ea…
-
Medium 5.4
Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth st…
-
Medium 4.3
Tenda F6 Web Management cross-site request forgery
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has bee…
-
Medium 5.3
CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the u…