Skip to content
BackEsc
Sign in

connection · two weakness classes

Cross-Site Request Forgery with Cross-site Scripting

248 CVEs

Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.

check available
1
likely to be exploited
1

Every one of the 248 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Shield Security Plugin < 20.0.6 - Cross-Site ScriptingCVE-2024-7313Getshieldsecurity · CVSS 6.1 · 1.6% likely

    CWE-352

  2. Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRFCVE-2023-0603Sloth Logo Customizer Project · CVSS 8.8 · 14% likely

    CWE-79

  3. Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesCVE-2022-32533Apache Software Foundation · CVSS 9.8 · 4.2% likely

    CWE-79Apache

  4. Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)CVE-2021-24581Blue-Admin Project · 4.1% likely

    CWE-352

  5. An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name,…CVE-2018-7746Cobub · 3.1% likely

    CWE-79Cobub

  6. A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.CVE-2018-6940Nat32 · 2.8% likely

    CWE-79

  7. CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege EscalationCVE-2021-34620WP Manage Ninja · CVSS 8.8 · 2.6% likely

    CWE-352WP ManageNinja LLC

  8. An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components…CVE-2018-10554Nagios · 2.6% likely

    CWE-79Nagios

  9. RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.CVE-2018-15884Ricoh · 2.5% likely

    CWE-79Ricoh

  10. Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.CVE-2018-14575Mybb · 2.4% likely

    CWE-79Mybb

  11. The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this,…CVE-2019-11193Directadmin · 2.1% likely

    CWE-79Directadmin

  12. Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address bookCVE-2013-6364Horde · 2.1% likely

    CWE-79Horde

  13. In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062Wordpress · 1.8% likely

    CWE-79WordPress

  14. A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading t…CVE-2020-35942Imagely · 1.4% likely

    CWE-79Imagely

  15. admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat&#95;number, billing&#95;name, company, or billing&#95;address parameter. This is exploitable via CSRF.CVE-2019-13364Piwigo · 1.4% likely

    CWE-79Piwigo

  16. admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm&#95;send&#95;html&#95;mail, nbm&#95;send&#95;mail&#95;as, nbm&#95;send&#95;detailed&#95;content, nbm&#95;co…CVE-2019-13363Piwigo · 1.4% likely

    CWE-79Piwigo

  17. An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XS…CVE-2019-12934Wp-Code-Highlightjs Project · 1.3% likely

    CWE-79

  18. Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.CVE-2018-8979Open-Audit · 1.2% likely

    CWE-79Open-Audit

  19. Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a w…CVE-2019-12095Horde · 1.1% likely

    CWE-79Horde

  20. php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admi…CVE-2016-11085Expresstech · 1.0% likely

    CWE-79ExpressTech

  21. ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site ScriptingCVE-2015-20105Cbads · 1.0% likely

    CWE-79

  22. TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery VulnerabilitiesCVE-2019-8991TIBCO Software Inc. · CVSS 8.8 · 0.9% likely

    CWE-79TIBCO Software Inc.

  23. A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_files.cgi re…CVE-2019-16068Netsas · 0.9% likely

    CWE-79Netsas

  24. On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the wors…CVE-2019-6636F5 · 0.9% likely

    CWE-79F5

  25. phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.CVE-2021-46426Phpipam · 0.9% likely

    CWE-79Phpipam

  26. An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave…CVE-2018-19525Systrome · 0.9% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in