recorded together · two weakness classes
Cross-Site Request Forgery and File and Path Handling
38 CVEs
38 CVEs name a weakness of both Cross-Site Request Forgery and File and Path Handling, fewer than chance alone would give (about 93). The pairing most often behind it is CWE-352 (Cross-Site Request Forgery) with CWE-434 (Unrestricted File Upload), in 16 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 38
- Chance alone would give
- about 93
- So they are recorded together
- less often than chance (0.4×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 2
Every one of the 38 is a mark on the map. Named now: 1 to 26, most at risk first.
- Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion
- Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload
- Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections
- Cross-site Request Forgery leading to RCE in SOY CMS
- The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal,…
- The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory trave…
- The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directo…
- OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
- WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI.
- An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a…
- Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin
- Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload
- Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF
- The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
- Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF
- Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
- CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF
- WordPress Rara One Click Demo Import plugin <= 1.2.9 - Cross-Site Request Forgery (CSRF) leads to Arbitrary File Upload vulnerability
- Email Artillery <= 4.1 - Arbitrary File Upload
- GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
- In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attack…
- SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download
- Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
- Chunghwa Telecom TenderDocTransfer - Arbitrary File Write
- RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.