Export limit exceeded: 11121 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,121

Export CSV
CVE-2024-49795

IBM ApplinX Cross-Site Request Forgery

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Applinx
CVE-2024-49794

IBM ApplinX Cross-Site Request Forgery

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Applinx
CVE-2024-31988

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, by getting an admin user to either visit a crafted URL or to view an image with this URL that could be in a comment, the attacker can get the admin to execute arbitrary XWiki syntax including scripting macros with Groovy or Python code. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9. As a workaround, one may update `RTFrontend.ConvertHTML` manually with the patch. This will, however, break some synchronization processes in the realtime editor, so upgrading should be the preferred way on installations where this editor is used.

CVSS 3.1 · 9.7 Critical EPSS < 1% KEV · Not listed
Vendors
Xwiki
Products
Xwiki
CVE-2021-23227

WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Php Everywhere Project
Products
Php Everywhere
CVE-2021-44777

WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion

Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Email Tracker Project
Products
Email Tracker
CVE-2022-23983

WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-buy
Products
Wp Content Copy Protection \& No Right Click
CVE-2022-25599

WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Spiffyplugins
Products
Spiffy Calendar
CVE-2022-25608

WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/Delete

Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Yooslider
Products
Yoo Slider
CVE-2022-25615

WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion

Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemixthemes
Products
Eroom - Zoom Meetings \& Webinar
CVE-2022-25614

WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability

Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemixthemes
Products
Eroom - Zoom Meetings \& Webinar
CVE-2021-36914

WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Claderaform
Products
Calderawp License Manager
CVE-2022-27847

WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import

Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yooslider
Products
Yoo Slider
CVE-2022-27846

WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Slider Creation / Modification

Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yooslider
Products
Yoo Slider
CVE-2022-27850

WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Plugin-planet
Products
Simple Ajax Chat
CVE-2022-27851

WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dineshkarki
Products
Use Any Font
CVE-2022-23976

WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)

Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Accesspressthemes
Products
Access Demo Importer
CVE-2022-27860

WordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Footer-text Project
Products
Footer-text
CVE-2022-29413

WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hermit Project
Products
Hermit
CVE-2022-29412

WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, create source.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hermit Project
Products
Hermit
CVE-2022-29414

WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpkube
Products
Subscribe To Comments Reloaded