Skip to content
OpenAdvisories

Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

  1. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

    For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]

    Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]

  2. Implementation

    Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

  3. Architecture and Design

    Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

  4. Architecture and Design

    Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

  5. Architecture and Design

    Use the "double-submitted cookie" method as described by Felten and Zeller:

    When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.

    Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.

    This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

  6. Architecture and Design

    Do not use the GET method for any request that triggers a state change.

  7. Implementation

    Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

6,780 results · Feed

  • High 7.1
    CVE-2025-23470

    WordPress Visit Site Link enhanced plugin <= 1.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.

    xavsio4 Visit Site Link enhanced
  • High 7.1
    CVE-2025-23467

    WordPress RSS News Scroller plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: from n/a through <= 2.0.0.

    vimal.ghorecha RSS News Scroller
  • Medium 4.3
    CVE-2024-10789

    WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update

    The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauth…

    WP Event Manager WP User Profile Avatar Web / CMS
  • Medium 4.3
    CVE-2024-57160

    07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaTask/edit.html.

  • Low 3.5
    CVE-2024-57611

    07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&…

  • Low 3.5
    CVE-2024-57159

    07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add…

  • Medium 4.3
    CVE-2024-57161

    07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/edi…

  • Medium 4.3
    CVE-2025-22731

    WordPress Build Private Store For Woocommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.

    silverplugins217 Build Private Store For Woocommerce Web / CMS
  • High 8.6
    CVE-2025-22784

    WordPress Background Control plugin <= 1.0.5 - CSRF to Arbitrary File Deletion vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.

    swedish boy Background Control
  • Medium 4.3
    CVE-2024-55893

    TYPO3 Cross-Site Request Forgery in Log Module

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-belog Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55894

    TYPO3 Cross-Site Request Forgery in Backend User Module

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-beuser Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55920

    Cross-Site Request Forgery in Dashboard Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-dashboard Web / CMS Packagist
  • High 7.5
    CVE-2024-55921

    Cross-Site Request Forgery in Extension Manager Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-extensionmanager Web / CMS Packagist
  • Medium 5.4
    CVE-2024-55922

    Cross-Site Request Forgery in Form Framework Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-form Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55923

    Cross-Site Request Forgery in Indexed Search Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-indexed-search Web / CMS Packagist
  • High 8.0
    CVE-2024-55924

    Cross-Site Request Forgery in Scheduler Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-scheduler Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55945

    Cross-Site Request Forgery in DB Check Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-lowlevel Web / CMS Packagist
  • Medium 6.5
    CVE-2025-21193

    Active Directory Federation Server Spoofing Vulnerability

    Active Directory Federation Server Spoofing Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • Medium 6.1
    CVE-2025-23081

    Various security vulnerabilities in Extension:DataTransfer

    Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XS…

    Wikimedia Foundation Mediawiki - DataTransfer Extension mediawiki/data-transfer Web / CMS Packagist
  • High 7.1
    CVE-2024-47100

    A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 12…

    Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC SIMATIC S7-1200 CPU 1214C AC/DC/Rly SIMATIC S7-1200 CPU 1211C DC/DC/DC ICS / OT
  • Medium 6.1
    CVE-2025-0393

    Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

    The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes …

    WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS
  • High 8.8
    CVE-2024-50858 Public exploit

    Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute acti…

  • Medium 5.4
    CVE-2023-42234

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView f…

  • High 7.5
    CVE-2025-22963 Public exploit

    Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

    Sismics Teedy
  • High 8.7
    CVE-2024-6662

    CSRF in MegaBIP

    Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would…

    Jan Syski MegaBIP
  • Low 3.4
    CVE-2025-23113

    An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while perf…

    Vanderbilt REDCap
  • Medium 4.5
    CVE-2024-13304

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    Drupal Minify JS drupal/minifyjs Packagist
  • Low 3.1
    CVE-2024-13293

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Low 3.5
    CVE-2024-13261

    Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

    Drupal Acquia DAM drupal/acquia_dam Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist
  • High 7.1
    CVE-2025-22814

    WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

    Dylan James Zephyr Admin Theme
  • Medium 6.1
    CVE-2024-12218

    Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

    The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated a…

    phoeniixx Woocommerce check pincode/zipcode for shipping Web / CMS
  • Medium 4.3
    CVE-2024-12206

    Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion

    The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stm_header_builder page. This makes it possib…

    stylemix Pearl – Header Builder Web / CMS
  • Medium 4.3
    CVE-2024-12605

    AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Cross-Site Request Forgery to Settings Update

    The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5. This is due…

    opacewebdesign Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic Web / CMS
  • Medium 4.3
    CVE-2024-13203

    kurniaramadhan E-Commerce-PHP cross-site request forgery

    A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The vendor was contacte…

    kurniaramadhan E-Commerce-PHP
  • Medium 4.3
    CVE-2025-22503

    WordPress Admin debug wordpress – enable debug Plugin <= 1.0.13 - Cross Site Request Forgery vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in digitalzoomstudio Admin debug wordpress – enable debug dzs-enable-debug allows Cross Site Request Forgery.This issue affects Admin debug wordpress – enable debug: from n/a through <= 1.0.13.

    Digital zoom studio Admin debug wordpress – enable debug Web / CMS
  • High 7.1
    CVE-2025-22520

    WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through <= 1.1.

    Tock Tock Widget