Total
8582 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-5893 | 1 Sfu | 1 Pkp Web Application Library | 2025-02-27 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | ||||
| CVE-2023-5899 | 1 Pkp | 1 Pkp Web Application Library | 2025-02-27 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | ||||
| CVE-2023-5902 | 1 Sfu | 1 Pkp Web Application Library | 2025-02-27 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | ||||
| CVE-2023-5898 | 1 Pkp | 1 Pkp Web Application Library | 2025-02-27 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | ||||
| CVE-2023-5897 | 1 Sfu | 1 Customlocale | 2025-02-27 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1. | ||||
| CVE-2023-27234 | 1 Jizhicms | 1 Jizhicms | 2025-02-27 | 6.5 Medium |
| A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application. | ||||
| CVE-2023-27073 | 1 Online Food Ordering System Project | 1 Online Food Ordering System | 2025-02-27 | 6.5 Medium |
| A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request. | ||||
| CVE-2023-51486 | 1 Rednao | 1 Woocommerce Pdf Invoice Builder | 2025-02-27 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101. | ||||
| CVE-2023-51491 | 1 Depicter | 1 Depicter | 2025-02-27 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6. | ||||
| CVE-2023-51510 | 1 Atlasgondal | 1 Export All Urls | 2025-02-27 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0. | ||||
| CVE-2023-51489 | 1 Automattic | 1 Crowdsignal Dashboard | 2025-02-27 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11. | ||||
| CVE-2023-51487 | 1 Ari-soft | 1 Ari Stream Quiz | 2025-02-27 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32. | ||||
| CVE-2024-12526 | 1 Arena.im | 1 Arena.im | 2025-02-27 | 4.3 Medium |
| The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.0. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2023-0497 | 1 Hasthemes | 1 Ht Portfolio | 2025-02-26 | 4.3 Medium |
| The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2022-4148 | 1 Dash10 | 1 Oauth Server | 2025-02-26 | 4.3 Medium |
| The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client. | ||||
| CVE-2024-13560 | 2025-02-26 | 4.3 Medium | ||
| The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-13339 | 1 Debounce | 1 Email Validator | 2025-02-26 | 6.1 Medium |
| The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.6. This is due to missing or incorrect nonce validation on the 'debounce_email_validator' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-12385 | 1 Kevonadonis | 1 Wp Abstracts | 2025-02-25 | 6.1 Medium |
| The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2023-28674 | 1 Jenkins | 1 Octoperf Load Testing | 2025-02-25 | 8.8 High |
| A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. | ||||
| CVE-2023-28671 | 1 Jenkins | 1 Octoperf Load Testing | 2025-02-25 | 4.3 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||