Total
7510 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-6024 | 1 Adamsolymosi | 1 Contentlock | 2025-05-15 | N/A | 8.8 HIGH |
| The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack | |||||
| CVE-2024-3632 | 1 Codepeople | 1 Smart Image Gallery | 2025-05-15 | N/A | 6.8 MEDIUM |
| The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2022-42087 | 1 Tenda | 2 Ax1803, Ax1803 Firmware | 2025-05-15 | N/A | 6.5 MEDIUM |
| Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. | |||||
| CVE-2024-5030 | 1 Cminds | 1 Cm Table Of Contents | 2025-05-15 | N/A | 3.8 LOW |
| The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack | |||||
| CVE-2022-42086 | 1 Tenda | 2 Ax1803, Ax1803 Firmware | 2025-05-15 | N/A | 6.5 MEDIUM |
| Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode. | |||||
| CVE-2022-41500 | 1 Eyoucms | 1 Eyoucms | 2025-05-15 | N/A | 8.8 HIGH |
| EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components. | |||||
| CVE-2022-41489 | 1 Wayos | 12 Lq-04, Lq-04 Firmware, Lq-05 and 9 more | 2025-05-15 | N/A | 8.1 HIGH |
| WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usb_upload.htm. | |||||
| CVE-2022-35611 | 1 Bevywise | 1 Mqttroute | 2025-05-15 | N/A | 4.3 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards. | |||||
| CVE-2024-5029 | 1 Cminds | 1 Cm Table Of Contents | 2025-05-15 | N/A | 4.8 MEDIUM |
| The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | |||||
| CVE-2024-8157 | 1 Web-argument | 1 Alphabetical List | 2025-05-15 | N/A | 4.3 MEDIUM |
| The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2022-41475 | 1 Rpcms | 1 Rpcms | 2025-05-15 | N/A | 8.8 HIGH |
| RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account. | |||||
| CVE-2022-41474 | 1 Rpcms | 1 Rpcms | 2025-05-15 | N/A | 6.5 MEDIUM |
| RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account. | |||||
| CVE-2024-3405 | 1 Goprayer | 1 Wp Prayer | 2025-05-15 | N/A | 7.6 HIGH |
| The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-3406 | 1 Goprayer | 1 Wp Prayer | 2025-05-15 | N/A | 8.8 HIGH |
| The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-3407 | 1 Goprayer | 1 Wp Prayer | 2025-05-15 | N/A | 5.3 MEDIUM |
| The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks | |||||
| CVE-2024-3629 | 1 Dachande663 | 1 Hl Twitter | 2025-05-15 | N/A | 2.4 LOW |
| The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | |||||
| CVE-2024-3631 | 1 Dachande663 | 1 Hl Twitter | 2025-05-15 | N/A | 4.3 MEDIUM |
| The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack | |||||
| CVE-2024-3823 | 1 Mranderson | 1 Base64 Encoderdecoder | 2025-05-15 | N/A | 2.4 LOW |
| The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | |||||
| CVE-2024-3824 | 1 Mranderson | 1 Base64 Encoderdecoder | 2025-05-15 | N/A | 5.5 MEDIUM |
| The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack | |||||
| CVE-2025-4282 | 1 Oretnom23 | 1 Stock Management System | 2025-05-14 | 5.0 MEDIUM | 4.3 MEDIUM |
| A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||