Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9681 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2012-10010 1 Bestwebsoft 1 Contact Form 2024-11-21 4.3 Medium
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
CVE-2012-0699 1 Haudenschilt 1 Family Connections Cms 2024-11-21 N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
CVE-2011-5328 1 User Access Manager Project 1 User Access Manager 2024-11-21 N/A
The user-access-manager plugin before 1.2 for WordPress has CSRF.
CVE-2011-5250 1 Prophecyinternational 1 Snare 2024-11-21 6.5 Medium
Snare for Linux before 1.7.0 has CSRF in the web interface.
CVE-2011-4952 1 Cobblerd 1 Cobbler 2024-11-21 8.8 High
cobbler: Web interface lacks CSRF protection when using Django framework
CVE-2011-3612 1 Usebb 1 Usebb 2024-11-21 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
CVE-2011-3609 1 Redhat 1 Jboss Application Server 2024-11-21 6.5 Medium
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVE-2011-3582 1 Anelectron 1 Advanced Electron Forums 2024-11-21 8.8 High
A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.
CVE-2011-2934 1 Websitebaker 1 Websitebaker 2024-11-21 8.8 High
A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.
CVE-2011-1085 1 Smoothwall 1 Smoothwall Express 2024-11-21 8.8 High
CSRF vulnerability in Smoothwall Express 3.
CVE-2011-0525 1 Batavi 1 Batavi 2024-11-21 8.8 High
Batavi before 1.0 has CSRF.
CVE-2010-4241 1 Tiki 1 Tikiwiki Cms\/groupware 2024-11-21 8.8 High
Tiki Wiki CMS Groupware 5.2 has CSRF
CVE-2010-3305 1 Pixelpost 1 Pixelpost 2024-11-21 8.8 High
Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.
CVE-2023-0737 1 Wallabag 1 Wallabag 2024-11-20 6.5 Medium
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.
CVE-2024-11118 1 Bilbud 1 404 Error Monitor 2024-11-19 5.3 Medium
The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings() function. This makes it possible for unauthenticated attackers to make changes to plugin settings and clear up all the error logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2021-27701 2024-11-18 4.7 Medium
SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request.
CVE-2024-11143 1 Kognetiks 1 Kognetiks Chatbot 2024-11-18 4.3 Medium
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-11125 1 Get-simple 1 Getsimplecms 2024-11-15 4.3 Medium
A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-47914 2024-11-15 4.5 Medium
VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF)
CVE-2024-11136 2024-11-15 N/A
The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.