Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8088 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-43265 1 Analytify 1 Analytify - Google Analytics Dashboard 2024-09-12 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1.
CVE-2024-6852 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-6853 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVE-2024-6855 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVE-2024-6856 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-6925 1 Themetechmount 2 Truebooker, Truebooker-appointment-booking 2024-09-11 4.3 Medium
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVE-2024-43275 1 Xyzscripts 1 Insert Php Code Snippet 2024-09-11 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in xyzscripts.Com Insert PHP Code Snippet.This issue affects Insert PHP Code Snippet: from n/a through 1.3.6.
CVE-2024-8414 2 Munyweki, Sourcecodester 2 Insurance Management System, Insurance Management System 2024-09-06 4.3 Medium
A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-42792 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2024-09-05 3.5 Low
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
CVE-2024-43947 1 Dineshkarki 1 Wp Armour Extended 2024-09-04 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.
CVE-2024-8319 1 Themeific 1 Tourfic 2024-09-03 4.3 Medium
The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-42793 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2024-08-30 5.4 Medium
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page.
CVE-2024-8200 1 Smashballoon 1 Reviews Feed 2024-08-30 4.3 Medium
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' function. This makes it possible for unauthenticated attackers to update an API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-45264 2 Skyss, Skysystem 2 Arfa-cms, Arfa Cms 2024-08-30 8 High
A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges.
CVE-2024-43336 1 Wpusermanager 1 Wp User Manager 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager.This issue affects WP User Manager: from n/a through 2.9.10.
CVE-2024-43337 1 Getbrave 1 Brave 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
CVE-2024-43339 1 Webinarpress 1 Webinarpress 2024-08-27 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.
CVE-2024-43340 1 Advancedformintegration 1 Advanced Form Integration 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.
CVE-2024-43356 1 Bobbingwide 1 Oik 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0.
CVE-2024-43787 1 Eclipse 1 Hono 2024-08-23 5 Medium
Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.