CWE-352 Cross-Site Request Forgery (CSRF)
compoundThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (10343)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-62593US | high8.8OT critical | KEV | ||
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox an… | ||||
| CVE-2023-2533US | high8.8OT critical | KEV | ||
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF, which, under specific conditions, could potentially enable
an attacker to alter security se… | ||||
| CVE-2020-10181US | critical9.8OT critical | KEV | ||
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by… | ||||
| CVE-2016-6277US | high8.8OT critical | KEV | ||
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.… | ||||
| CVE-2016-3718US | medium5.5OT critical | KEV | ||
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted ima… | ||||
| CVE-2014-100005US | high8.0OT critical | KEV | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of ad… | ||||
| CVE-2008-4128US | high9.3OT critical | KEV | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to ex… | ||||
| CVE-2022-41622US | high8.8 | Exploit | ||
In all versions,
BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.
Note: Software versions which have reached End of Technic… | ||||
| CVE-2019-16667US | high8.8 | Exploit | ||
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces… | ||||
| CVE-2025-54782US | high8.8 | Exploit | ||
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the… | ||||
| CVE-2018-7700US | high8.8 | — | ||
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP… | ||||
| CVE-2015-6973US | medium6.8 | Exploit | ||
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests tha… | ||||
| CVE-2015-2295US | medium6.8 | Exploit | ||
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication… | ||||
| CVE-2014-0054US | medium6.8 | — | ||
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote atta… | ||||
| CVE-2013-6429US | medium6.8 | — | ||
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attack… | ||||
| CVE-2019-9787US | high8.8 | Exploit | ||
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF prot… | ||||
| CVE-2022-27226US | high8.8 | Exploit | ||
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequen… | ||||
| CVE-2019-0235US | high8.8 | Exploit | ||
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. | ||||
| CVE-2017-1000479US | high8.8 | Exploit | ||
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occu… | ||||
| CVE-2013-3568US | high8.8 | Exploit | ||
Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan