Cross-Site Request Forgery

Every one of the 55 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session…CVE-2007-6752Drupal · 3.6% likely

   CWE-352

2. Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletio…CVE-2008-3220Drupal · 1.3% likely

   CWE-352

3. The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a…CVE-2015-6660Drupal · 1.3% likely

   CWE-352

4. Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery…CVE-2007-5594Drupal · 1.2% likely

   CWE-352

5. Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identit…CVE-2008-3221Drupal · 1.2% likely

   CWE-352

6. Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as pr…CVE-2008-0272Drupal · 1.2% likely

   CWE-352

7. Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unsp…CVE-2012-0826Drupal · 0.9% likely

   CWE-352

8. Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for r…CVE-2008-3744Drupal · 0.9% likely

   CWE-352

9. Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to…CVE-2008-3743Drupal · 0.9% likely

   CWE-352

10. Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated…CVE-2017-6379Drupal · 0.8% likely

    CWE-352

11. Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized action…CVE-2008-6532Drupal · 0.8% likely

    CWE-352

12. Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote…CVE-2009-4066Drupal · 0.7% likely

    CWE-352

13. Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast votes for content via unspecified aspects…CVE-2009-1036Drupal · 0.7% likely

    CWE-352

14. Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.CVE-2020-13663Drupal · 0.7% likely

    CWE-352

15. Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request fo…CVE-2007-6320Drupal · 0.7% likely

    CWE-352

16. Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administ…CVE-2008-6384Drupal · 0.6% likely

    CWE-352

17. Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.CVE-2013-7407Drupal · 0.6% likely

    CWE-352

18. Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x…CVE-2008-6169Drupal · 0.6% likely

    CWE-352

19. The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote a…CVE-2008-0271Drupal · 0.5% likely

    CWE-352

20. The point moderation form in the Userpoints 4.7.x before 4.7.x-2.3, 5.x-2 before 5.x-2.16, and 5.x-3 before 5.x-3.3 module for Drupal does not follow Drupal's Forms API submission…CVE-2008-0571Drupal · 0.5% likely

    CWE-352

21. The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.…CVE-2020-13674Drupal · 0.5% likely

    CWE-352

22. The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into…CVE-2020-13673Drupal · 0.3% likely

    CWE-352

23. Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019CVE-2025-31690Drupal · CVSS 8.8 · 0.2% likely

    CWE-352

24. AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003CVE-2025-31677Drupal · CVSS 8.8 · 0.2% likely

    CWE-352

25. General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018CVE-2025-31689Drupal · CVSS 8.1 · 0.2% likely

    CWE-352

26. Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014CVE-2024-13250Drupal · CVSS 8.8 · 0.2% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.