Skip to content
BackEsc
Sign in

CWE-352 · weakness in Cross-Site Request Forgery

Cross-Site Request Forgery

9,636 CVEs · 5 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
5
check available
14
likely to be exploited
37

Every one of the 9,636 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. NETGEAR Routers - Remote Code ExecutionCVE-2016-6277NETGEAR · CVSS 8.8 · 100% likely

    NETGEAR

  2. Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of a…CVE-2014-100005D-Link · CVSS 8 · 43% likely

    D-Link

  3. Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to e…CVE-2008-4128Cisco · CVSS 8.1 · 34% likelycovered by CyberSIXT

    Cisco

  4. PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRFCVE-2023-2533PaperCut · CVSS 8.4 · 29% likely

    PaperCut

  5. goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated b…CVE-2020-10181Sumavision · CVSS 9.8 · 15% likely

    Sumavision

  6. DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code ExecutionCVE-2018-770074% likely
  7. ZTE MF971R - Referer authentication bypassCVE-2021-21745MF971R · 56% likely
  8. Selenium Grid < 4.0.0-alpha-7 - Remote Code ExecutionCVE-2022-2810823% likely
  9. MAGMI - Cross-Site Request ForgeryCVE-2020-5776MAGMI · 15% likely
  10. Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request ForgeryCVE-2020-861511% likely
  11. PublishPress Capabilities < 2.3.1 - Missing AuthorizationCVE-2021-25032PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus · 7.1% likely
  12. WordPress AB Google Map Travel <=3.4 - Stored Cross-Site ScriptingCVE-2015-27553.8% likely
  13. WordPress Button Generator <2.3.3 - Remote File InclusionCVE-2021-25052Button Generator – easily Button Builder · 3.0% likely
  14. Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege EscalationCVE-2019-118862.3% likely
  15. Shield Security Plugin < 20.0.6 - Cross-Site ScriptingCVE-2024-7313Getshieldsecurity · CVSS 6.1 · 1.6% likely
  16. Ozette Plugins - Cross-Site Request ForgeryCVE-2023-23897Ozette Plugins · CVSS 4.3 · 1.6% likely
  17. WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File DeletionCVE-2020-36836emrevona · CVSS 8 · 1.5% likely

    Emre Vona

  18. WordPress Popup Builder <= 4.1.11 - Cross-Site Request ForgeryCVE-2022-29495Sygnoos · CVSS 5.4 · 0.5% likely
  19. Bootstrap Multiselect <= 1.1.2 - Cross-Site ScriptingCVE-2025-47204Davidstutz · CVSS 6.1 · 0.5% likely
  20. iControl SOAP vulnerabilityCVE-2022-41622F5 · CVSS 8.8 · 92% likely

    F5

  21. The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote att…CVE-2014-005491% likely
  22. The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attac…CVE-2013-642991% likely
  23. Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication…CVE-2015-229566% likely
  24. Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests th…CVE-2015-697365% likely
  25. Apache JSPWiki CSRF in UserPreferences.jspCVE-2022-28731Apache Software Foundation · 59% likely

    Apache

  26. Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to o…CVE-2007-004457% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in