CWE-352 · Cross-Site Request Forgery
Cross-Site Request Forgery
9,637CVEs
5exploited
14with a public check
37likely (EPSS 10%+)
SortMost likely exploited
9,637 CVEs with CWE-352 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2016-6277In CISA KEVExploitedNETGEAR Routers - Remote Code ExecutionNETGEAR · Multiple Routers · CVSS 8.8 · 2016-12-14 | 8.8 | 100% | 2016-12-14 |
| CVE-2014-100005In CISA KEVExploitedMultiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of a…D-Link · DIR-600 Router · CVSS 8 · 2015-01-13 | 8.0 | 43% | 2015-01-13 |
| CVE-2008-4128In CISA KEVExploitedMultiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to e…Cisco · IOS · CVSS 8.1 · 2008-09-18 | 8.1 | 34% | 2008-09-18 |
| CVE-2023-2533In CISA KEVExploitedPaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRFPaperCut · PaperCut NG/MF · CVSS 8.4 · 2023-06-20 | 8.4 | 29% | 2023-06-20 |
| CVE-2020-10181In CISA KEVExploitedgoform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated b…Sumavision · Enhanced Multimedia Router (EMR) · CVSS 9.8 · 2020-03-11 | 9.8 | 15% | 2020-03-11 |
| CVE-2018-7700CheckDedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code ExecutionDedecms · Dedecms · 2018-03-27 | – | 74% | 2018-03-27 |
| CVE-2021-21745CheckZTE MF971R - Referer authentication bypassZte · MF971R · 2021-10-20 | – | 56% | 2021-10-20 |
| CVE-2022-28108CheckSelenium Grid < 4.0.0-alpha-7 - Remote Code ExecutionSelenium · Selenium Grid · 2022-04-19 | – | 23% | 2022-04-19 |
| CVE-2020-5776CheckMAGMI - Cross-Site Request ForgeryMagmi Project · MAGMI · 2020-09-01 | – | 15% | 2020-09-01 |
| CVE-2020-8615CheckWordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request ForgeryThemeum · Tutor Lms · 2020-02-04 | – | 11% | 2020-02-04 |
| CVE-2021-25032CheckPublishPress Capabilities < 2.3.1 - Missing AuthorizationPublishpress · PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus · 2022-01-10 | – | 7.1% | 2022-01-10 |
| CVE-2015-2755CheckWordPress AB Google Map Travel <=3.4 - Stored Cross-Site ScriptingAb Google Map Travel Project · Ab Google Map Travel · 2015-04-01 | – | 3.8% | 2015-04-01 |
| CVE-2021-25052CheckWordPress Button Generator <2.3.3 - Remote File InclusionWow-Company · Button Generator – easily Button Builder · 2022-01-10 | – | 3.0% | 2022-01-10 |
| CVE-2019-11886CheckYellow Pencil Visual Theme Customizer < 7.2.1 - Privilege EscalationYellowpencil · Visual Css Style Editor · 2019-05-13 | – | 2.3% | 2019-05-13 |
| CVE-2024-7313CheckShield Security Plugin < 20.0.6 - Cross-Site ScriptingGetshieldsecurity · Shield Security · CVSS 6.1 · 2024-08-26 | 6.1 | 1.6% | 2024-08-26 |
| CVE-2023-23897CheckOzette Plugins - Cross-Site Request ForgeryOzette Plugins · Simple Mobile URL Redirect · CVSS 4.3 · 2023-07-10 | 4.3 | 1.6% | 2023-07-10 |
| CVE-2020-36836CheckWordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletionemrevona · WP Fastest Cache – WordPress Cache Plugin · CVSS 8 · 2024-10-16 | 8.0 | 1.5% | 2024-10-16 |
| CVE-2022-29495CheckWordPress Popup Builder <= 4.1.11 - Cross-Site Request ForgerySygnoos · Popup Builder (WordPress plugin) · CVSS 5.4 · 2022-07-22 | 5.4 | 0.5% | 2022-07-22 |
| CVE-2025-47204CheckBootstrap Multiselect <= 1.1.2 - Cross-Site ScriptingDavidstutz · Bootstrap Multiselect · CVSS 6.1 · 2025-05-13 | 6.1 | 0.5% | 2025-05-13 |
| CVE-2022-41622iControl SOAP vulnerabilityF5 · BIG-IP · CVSS 8.8 · 2022-12-07 | 8.8 | 92% | 2022-12-07 |
| CVE-2014-0054The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote att…Springsource · Spring Framework · 2014-04-17 | – | 91% | 2014-04-17 |
| CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attac…Pivotal Software · Spring Framework · 2014-01-26 | – | 91% | 2014-01-26 |
| CVE-2015-2295Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication…Netgate · Pfsense · 2015-04-10 | – | 66% | 2015-04-10 |
| CVE-2015-6973Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests th…Igniterealtime · Openfire · 2015-09-16 | – | 65% | 2015-09-16 |
| CVE-2022-28731Apache JSPWiki CSRF in UserPreferences.jspApache Software Foundation · Apache JSPWiki · 2022-08-04 | – | 59% | 2022-08-04 |
| CVE-2007-0044Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to o…Adobe · Acrobat · 2007-01-03 | – | 57% | 2007-01-03 |
| CVE-2019-16667diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produce…Netgate · Pfsense · 2019-09-26 | – | 55% | 2019-09-26 |
| CVE-2020-2184A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.Jenkins project · Jenkins CVS Plugin · 2020-05-06 | – | 44% | 2020-05-06 |
| CVE-2019-9787WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF pro…Wordpress · Wordpress · 2019-03-14 | – | 39% | 2019-03-14 |
| CVE-2022-27226A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will conseque…Irz · Ru21 Firmware · 2022-03-19 | – | 34% | 2022-03-19 |
| CVE-2019-0235Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.Apache · Apache OFBiz · 2020-04-30 | – | 33% | 2020-04-30 |
| CVE-2017-1000479pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occ…Netgate · Pfsense · 2018-01-03 | – | 32% | 2018-01-03 |
| CVE-2016-6897Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hija…Wordpress · Wordpress · 2017-01-18 | – | 29% | 2017-01-18 |
| CVE-2011-4642mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators…Splunk · Splunk · 2012-01-03 | – | 29% | 2012-01-03 |
| CVE-2022-23111A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacke…Jenkins project · Jenkins Publish Over SSH Plugin · 2022-01-12 | – | 27% | 2022-01-12 |
| CVE-2013-3568Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via…Cisco · Linksys Wrt110 Firmware · 2020-02-06 | – | 25% | 2020-02-06 |
| CVE-2023-48292XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacksxwiki-contrib · application-admintools · CVSS 9.7 · 2023-11-20 | 9.7 | 23% | 2023-11-20 |
| CVE-2014-4671Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before…Adobe · Flash Player · 2014-07-09 | – | 22% | 2014-07-09 |
| CVE-2019-12616An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick th…Phpmyadmin · Phpmyadmin · 2019-06-05 | – | 20% | 2019-06-05 |
| CVE-2023-22457org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgeryxwiki-contrib · application-ckeditor · CVSS 9.1 · 2023-01-04 | 9.1 | 19% | 2023-01-04 |
| CVE-2019-12624Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery VulnerabilityCisco · Cisco IOS XE Software · CVSS 8.8 · 2019-08-21 | 8.8 | 18% | 2019-08-21 |
| CVE-2019-7262Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).Nortekcontrol · Linear Emerge Essential Firmware · 2019-07-02 | – | 16% | 2019-07-02 |
| CVE-2017-9414Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims f…Subsonic · Subsonic · 2018-02-05 | – | 15% | 2018-02-05 |
| CVE-2019-19833In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a us…Tautulli · Tautulli · 2019-12-18 | – | 15% | 2019-12-18 |
| CVE-2019-7391ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.Zyxel · Dsl-491hnu-B10b Firmware · 2019-03-17 | – | 14% | 2019-03-17 |
| CVE-2019-6967AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.Airties · Air 5341 Firmware · 2019-03-17 | – | 13% | 2019-03-17 |
| CVE-2024-2449LoadMaster Cross-Site Request Forgery (CSRF)Progress Software · LoadMaster · CVSS 7.5 · 2024-03-22 | 7.5 | 13% | 2024-03-22 |
| CVE-2020-23342A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.Anchorcms · Anchor Cms · 2021-01-19 | – | 12% | 2021-01-19 |
| CVE-2013-3690Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models wit…Brickcom · Fb-100ap · 2013-10-01 | – | 12% | 2013-10-01 |
| CVE-2018-11538servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.Searchblox · Searchblox · 2018-06-01 | – | 12% | 2018-06-01 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.