Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9965 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-12301 1 Joomlaserviceprovider 1 Jsp Store Locator 2025-06-09 6.5 Medium
The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
CVE-2024-12282 1 Smyx 1 Wp-connect 2025-06-09 6.1 Medium
The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-10634 1 Nokautpl 1 Nokaut Offers Box 2025-06-09 4.3 Medium
The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF attack
CVE-2021-22876 9 Broadcom, Debian, Fedoraproject and 6 more 15 Fabric Operating System, Debian Linux, Fedora and 12 more 2025-06-09 5.3 Medium
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
CVE-2025-5521 1 5kcrm 1 Wukongcrm 2025-06-09 4.3 Medium
A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-5155 1 Ravster 1 Inquiry Cart 2025-06-06 6.1 Medium
The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-50858 1 Gestioip 1 Gestioip 2025-06-06 8.8 High
Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.
CVE-2024-28158 1 Jenkins 1 Subversion Partial Release Manager 2025-06-06 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers to trigger a build.
CVE-2025-24398 1 Jenkins 1 Bitbucket Server Integration 2025-06-06 8.8 High
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVE-2025-36513 2025-06-06 N/A
Cross-site request forgery vulnerability exists in surveillance cameras provided by i-PRO Co., Ltd.. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.
CVE-2024-42553 1 Vaibhavverma9999 1 Hotel Management System 2025-06-05 8.8 High
A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
CVE-2024-42555 1 Vaibhavverma9999 1 Hotel Management System 2025-06-05 8.8 High
A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
CVE-2024-42557 1 Vaibhavverma9999 1 Hotel Management System 2025-06-05 8.8 High
A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
CVE-2022-32555 1 Unisys 1 Data Exchange Management Studio 2025-06-05 8.8 High
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.
CVE-2024-22817 1 Flycms Project 1 Flycms 2025-06-05 8.8 High
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
CVE-2024-22699 1 Flycms Project 1 Flycms 2025-06-05 8.8 High
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.
CVE-2023-25987 1 Urosevic 1 My Youtube Channel 2025-06-05 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Aleksandar Urošević My YouTube Channel plugin <= 3.23.3 versions.
CVE-2023-47785 1 Kreaturamedia 1 Layerslider 2025-06-05 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.
CVE-2023-47819 1 Dangngocbinh 1 Easy Call Now By Thikshare 2025-06-05 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.
CVE-2023-49673 2 Jenkins, Jenkins Project 5 Google Compute Engine, Jira, Matlab and 2 more 2025-06-05 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.