WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-352✕
Overview 488 matches · 6 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 5 EPSS ≥ 0.5
488matches 6in Waratek scope1.2% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 5EPSS ≥ 0.51.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 6 1.2% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 482 98.8% Withdrawn CVE 0 0.0%
Critical 2 0.4% High 174 35.7% Medium 310 63.5% Low 2 0.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 488 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 488 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 64 / year
Not applicable: 482Mitigation candidate: 6 Low: 2Medium: 310High: 174Critical: 2 not blocked: 488 Working exploit published: 488
20043 Not applicable3 High2 Medium1 not blocked3 Working exploit published3 20051 Not applicable1 Medium1 not blocked1 Working exploit published1 20061 Not applicable1 Medium1 not blocked1 Working exploit published1 20078 Not applicable8 Medium8 not blocked8 Working exploit published8 200810 Not applicable10 High1 Medium8 Low1 not blocked10 Working exploit published10 200933 Mitigation candidate1 Not applicable32 High1 Medium32 not blocked33 Working exploit published33 201024 Not applicable24 High1 Medium23 not blocked24 Working exploit published24 201112 Mitigation candidate1 Not applicable11 Medium12 not blocked12 Working exploit published12 201247 Not applicable47 Medium46 Low1 not blocked47 Working exploit published47 201331 Mitigation candidate1 Not applicable30 High2 Medium29 not blocked31 Working exploit published31 201464 Not applicable64 High2 Medium62 not blocked64 Working exploit published64 201543 Not applicable43 High1 Medium42 not blocked43 Working exploit published43 20166 Not applicable6 High6 not blocked6 Working exploit published6 201752 Not applicable52 Critical1 High43 Medium8 not blocked52 Working exploit published52 201860 Mitigation candidate1 Not applicable59 High53 Medium7 not blocked60 Working exploit published60 201936 Not applicable36 High25 Medium11 not blocked36 Working exploit published36 202020 Not applicable20 High12 Medium8 not blocked20 Working exploit published20 202112 Not applicable12 High9 Medium3 not blocked12 Working exploit published12 202213 Mitigation candidate1 Not applicable12 High8 Medium5 not blocked13 Working exploit published13 20233 Mitigation candidate1 Not applicable2 Critical1 High1 Medium1 not blocked3 Working exploit published3 20244 Not applicable4 High3 Medium1 not blocked4 Working exploit published4 20254 Not applicable4 High4 not blocked4 Working exploit published4 20261 Not applicable1 Medium1 not blocked1 Working exploit published1
200420062008201020122014201620182020202220242026
488 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 5 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-14620 Medium 2026-07-03 Not applicable Working exploit published webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
CVE-2025-65027 High 2025-12-03 Not applicable Working exploit published RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
CVE-2025-28062 High 2025-05-05 Not applicable Working exploit published A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
CVE-2024-56901 High 2025-02-03 Not applicable Working exploit published A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
CVE-2024-50858 High 2025-01-14 Not applicable Working exploit published Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.
CVE-2024-12955 Medium 2024-12-26 Not applicable Working exploit published A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as problematic. This vulnerability affects unknown code of the file /logout.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-48846 High 2024-12-05 Not applicable Working exploit published Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
CVE-2024-6244 High 2024-07-22 Not applicable Working exploit published The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-34069 High 2024-05-06 Not applicable Working exploit published Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
CVE-2023-48292 Critical 2023-11-20 Mitigation candidate Working exploit published The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.
CVE-2023-34927 Medium 2023-06-22 Not applicable Working exploit published Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
CVE-2022-4944 High 2023-04-22 Not applicable Working exploit published A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.
CVE-2022-41622 High 2022-12-07 Not applicable Working exploit published In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-41413 Medium 2022-11-30 Not applicable Working exploit published perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Search function.
CVE-2022-2846 Medium 2022-08-16 Not applicable Working exploit published The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.
CVE-2022-29495 Medium 2022-07-22 Not applicable Working exploit published Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.
CVE-2022-31886 Medium 2022-06-28 Not applicable Working exploit published Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.
CVE-2022-28108 High 2022-04-19 Mitigation candidate Working exploit published Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
CVE-2022-26180 High 2022-04-08 Not applicable Working exploit published qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
CVE-2022-0088 High 2022-04-03 Not applicable Working exploit published Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
CVE-2022-0439 High 2022-03-07 Not applicable Working exploit published The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
CVE-2022-25241 High 2022-02-16 Not applicable Working exploit published In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
CVE-2021-24947 Medium 2022-02-07 Not applicable Working exploit published The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
CVE-2021-46398 High 2022-02-04 Not applicable Working exploit published A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
CVE-2021-25052 High 2022-01-10 Not applicable Working exploit published The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
CVE-2021-24581 High 2021-08-30 Not applicable Working exploit published The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
CVE-2021-29995 High 2021-06-09 Not applicable Working exploit published A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.
CVE-2021-32403 High 2021-05-17 Not applicable Working exploit published Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe inputs and modules.
CVE-2021-24272 Medium 2021-05-05 Not applicable Working exploit published The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
CVE-2021-31762 High 2021-04-25 Not applicable Working exploit published Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.
CVE-2021-31152 High 2021-04-14 Not applicable Working exploit published Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers.
CVE-2021-30147 High 2021-04-07 Not applicable Working exploit published DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
CVE-2021-24174 High 2021-04-05 Not applicable Working exploit published The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
CVE-2021-27885 High 2021-03-02 Not applicable Working exploit published usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
CVE-2020-23522 Medium 2021-01-19 Not applicable Working exploit published Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.
CVE-2020-23342 High 2021-01-19 Not applicable Working exploit published A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
CVE-2020-35687 Medium 2021-01-13 Not applicable Working exploit published PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
CVE-2020-25015 Medium 2020-09-16 Not applicable Working exploit published A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password.
CVE-2020-13259 High 2020-09-16 Not applicable Working exploit published A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.
CVE-2020-25453 High 2020-09-15 Not applicable Working exploit published An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution.
CVE-2020-15600 Medium 2020-07-07 Not applicable Working exploit published An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15046 High 2020-06-24 Not applicable Working exploit published The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.
CVE-2020-11060 High 2020-05-12 Not applicable Working exploit published In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.
CVE-2019-0235 High 2020-04-30 Not applicable Working exploit published Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
CVE-2019-16068 High 2020-03-19 Not applicable Working exploit published A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_files.cgi request. This can be triggered via XSS or an IFRAME tag included within the site.
CVE-2012-2629 High 2020-02-20 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator account via an addnew action to admin/administrators_add.php; or (2) conduct cross-site scripting (XSS) attacks via the page_title parameter to admin/content_pages_edit.php; the (3) category_name[] parameter to admin/products_category.php; the (4) site_name, (5) seo_title, or (6) meta_keywords parameter to admin/settings_siteinfo.php; the (7) company_name, (8) address1, (9) address2, (10) city, (11) state, (12) country, (13) author_first_name, (14) author_last_name, (15) author_email, (16) contact_first_name, (17) contact_last_name, (18) contact_email, (19) general_email, (20) general_phone, (21) general_fax, (22) sales_email, (23) sales_phone, (24) support_email, or (25) support_phone parameter to admin/settings_company.php; or the (26) system_email, (27) sender_name, (28) smtp_server, (29) smtp_username, (30) smtp_password, or (31) order_notice_email parameter to admin/settings_email.php.
CVE-2013-2108 Medium 2020-02-10 Not applicable Working exploit published WordPress WP Cleanfix Plugin 2.4.4 has CSRF
CVE-2014-2225 High 2020-02-08 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request to api/add/admin; (2) have unspecified impact via a request to api/add/wlanconf; change the guest (3) password, (4) authentication method, or (5) restricted subnets via a request to api/set/setting/guest_access; (6) block, (7) unblock, or (8) reconnect users by MAC address via a request to api/cmd/stamgr; change the syslog (9) server or (10) port via a request to api/set/setting/rsyslogd; (11) have unspecified impact via a request to api/set/setting/smtp; change the syslog (12) server, (13) port, or (14) authentication settings via a request to api/cmd/cfgmgr; or (15) change the Unifi Controller name via a request to api/set/setting/identity.
CVE-2014-5288 High 2020-02-07 Not applicable Working exploit published A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
CVE-2020-8615 Medium 2020-02-04 Not applicable Working exploit published A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
CVE-2013-7053 High 2020-02-04 Not applicable Working exploit published D-Link DIR-100 4.03B07: cli.cgi CSRF
CVE-2020-8505 Medium 2020-01-31 Not applicable Working exploit published School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
CVE-2020-8504 Medium 2020-01-31 Not applicable Working exploit published School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
CVE-2020-8425 Medium 2020-01-28 Not applicable Working exploit published Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
CVE-2020-8424 High 2020-01-28 Not applicable Working exploit published Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.
CVE-2013-4865 Medium 2020-01-28 Not applicable Working exploit published Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs parameter.
CVE-2020-7991 High 2020-01-26 Not applicable Working exploit published Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
CVE-2015-5595 Medium 2019-12-31 Not applicable Working exploit published Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).
CVE-2014-3136 High 2019-12-27 Not applicable Working exploit published Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via unspecified vectors.
CVE-2013-4665 Medium 2019-12-27 Not applicable Working exploit published SPBAS Business Automation Software 2012 has CSRF.
CVE-2019-19516 Medium 2019-12-02 Not applicable Working exploit published Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.
CVE-2015-3140 High 2019-11-21 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
CVE-2012-4385 Medium 2019-11-13 Not applicable Working exploit published letodms 3.3.6 has CSRF via change password
CVE-2013-6364 High 2019-11-05 Not applicable Working exploit published Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
CVE-2013-6275 Medium 2019-11-05 Not applicable Working exploit published Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
CVE-2019-13529 High 2019-10-09 Not applicable Working exploit published An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
CVE-2019-16667 High 2019-09-26 Not applicable Working exploit published diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
CVE-2019-16531 High 2019-09-20 Not applicable Working exploit published LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVE-2019-12922 Medium 2019-09-13 Not applicable Working exploit published A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
CVE-2019-12624 High 2019-08-21 Not applicable Working exploit published A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
CVE-2019-14346 High 2019-08-06 Not applicable Working exploit published Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.
CVE-2019-14328 High 2019-07-28 Not applicable Working exploit published The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
CVE-2019-13961 High 2019-07-18 Not applicable Working exploit published A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVE-2019-7262 High 2019-07-02 Not applicable Working exploit published Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-7273 High 2019-07-01 Not applicable Working exploit published Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
CVE-2019-12616 Medium 2019-06-05 Not applicable Working exploit published An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
CVE-2019-10847 High 2019-05-24 Not applicable Working exploit published Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
CVE-2019-11569 High 2019-05-06 Not applicable Working exploit published Veeam ONE Reporter 9.5.0.3201 allows CSRF.
CVE-2019-11193 Medium 2019-04-30 Not applicable Working exploit published The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
CVE-2019-11416 High 2019-04-22 Not applicable Working exploit published A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/user.
CVE-2019-11375 Medium 2019-04-20 Not applicable Working exploit published Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
CVE-2019-11374 High 2019-04-20 Not applicable Working exploit published 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-10874 High 2019-04-05 Not applicable Working exploit published Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.
CVE-2019-7440 Medium 2019-03-21 Not applicable Working exploit published JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
CVE-2019-7391 High 2019-03-21 Not applicable Working exploit published ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
CVE-2019-6967 High 2019-03-21 Not applicable Working exploit published AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
CVE-2019-6282 High 2019-03-21 Not applicable Working exploit published ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.
CVE-2018-17996 Medium 2019-03-21 Not applicable Working exploit published LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.
CVE-2018-14575 High 2019-03-21 Not applicable Working exploit published Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject.
CVE-2019-9769 High 2019-03-14 Not applicable Working exploit published PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.
CVE-2019-9625 High 2019-03-07 Not applicable Working exploit published JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
CVE-2019-6710 High 2019-03-07 Not applicable Working exploit published Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
CVE-2019-6249 High 2019-01-13 Not applicable Working exploit published An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.
CVE-2018-19829 Medium 2018-12-18 Not applicable Working exploit published Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-18773 High 2018-11-20 Not applicable Working exploit published CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.
CVE-2018-18772 High 2018-11-20 Not applicable Working exploit published CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.
CVE-2018-18799 High 2018-11-16 Not applicable Working exploit published School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
CVE-2018-18797 High 2018-11-16 Not applicable Working exploit published School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
CVE-2018-18794 High 2018-11-16 Not applicable Working exploit published School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
CVE-2018-18760 Medium 2018-11-16 Not applicable Working exploit published RhinOS 3.0 build 1190 allows CSRF.
‹ prev page 1 of 5 next ›