connection · two weakness classes
Access Control with Cross-Site Request Forgery
281 CVEs
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.
- check available
- 5
Every one of the 281 is a mark on the map. Named now: 1 to 26, most at risk first.
- WordPress WooCommerce <3.1.2 - Arbitrary Function Call
- WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
- WordPress Sitemap by click5 <1.0.36 - Missing Authorization
- PublishPress Capabilities < 2.3.1 - Missing Authorization
- Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
- Tailscale Windows daemon is vulnerable to RCE via CSRF
- jsnjfz WebStack-Guns cross-site request forgery
- Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update
- OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion
- WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion
- OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
- The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and expl…
- PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
- Cross-Site Request Forgery in TYPO3 CMS
- The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
- Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update
- Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload
- miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
- HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion
- IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
- webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
- Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass
- Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
- Disable User Login <= 1.0.1 - Unauthenticated Settings Update
- annyshow DuxCMS cross-site request forgery
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP