CWE-352

{
  "affected": [],
  "aliases": [
    "CVE-2024-22287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-31T12:16:05Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Lud\u011bk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.",
  "id": "GHSA-5mwr-c944-45q4",
  "modified": "2026-04-28T21:33:51Z",
  "published": "2024-01-31T12:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22287"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/better-anchor-links/wordpress-better-anchor-links-plugin-1-7-5-csrf-to-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-6865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-29T17:15:21Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13. This affects an unknown part of the file /admin.php/addon/index. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-5mxq-jrf7-jcwr",
  "modified": "2025-06-29T18:30:28Z",
  "published": "2025-06-29T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6865"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wwm1995/weiming_wang/blob/main/daicuocms_1.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.314337"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.314337"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.603563"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-49964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-20T15:15:21Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink allows Cross Site Request Forgery. This issue affects ClipLink: from n/a through 1.1.",
  "id": "GHSA-5p23-m3gw-6963",
  "modified": "2026-04-01T18:35:30Z",
  "published": "2025-06-20T15:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49964"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/cliplink/vulnerability/wordpress-cliplink-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-01T12:16:15Z",
    "severity": "MODERATE"
  },
  "details": "The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the \u0027handle_module_actions\u0027 function. This makes it possible for unauthenticated attackers to toggle plugin modules on or off via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-5p3x-66m4-m895",
  "modified": "2026-05-01T12:30:25Z",
  "published": "2026-05-01T12:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3140"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ultimate-dashboard/trunk/modules/feature/class-feature-module.php#L120"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3479396"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcdb70f-77db-48ab-ae23-c46caecdd3be?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2009-0648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-02-19T16:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in the manage_users handler in admin/index.php in Falt4 CMS (aka Falt4 Extreme) RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the (1) edit and (2) edit_now actions.",
  "id": "GHSA-5p4c-rp79-gv64",
  "modified": "2022-05-02T03:17:08Z",
  "published": "2022-05-02T03:17:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0648"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48786"
    },
    {
      "type": "WEB",
      "url": "http://packetstorm.linuxsecurity.com/0902-exploits/falt4-cms-xsrf.txt"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33973"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-30549"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-24T14:15:23Z",
    "severity": "MODERATE"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes allows Cross Site Request Forgery. This issue affects Yummly Rich Recipes: from n/a through 4.2.",
  "id": "GHSA-5p4x-j869-mmj2",
  "modified": "2026-04-01T18:33:59Z",
  "published": "2025-03-24T15:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30549"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/yummly-rich-recipes/vulnerability/wordpress-yummly-rich-recipes-plugin-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sveltejs/kit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-29003"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-04T21:20:47Z",
    "nvd_published_at": "2023-04-04T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it\u2019s users. The protection is implemented at `kit/src/runtime/server/respond.js#L52`. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different `Content-Type` header value.\n\n### Details\nThe CSRF protection is implemented using the code shown below.\n\n```js\nconst forbidden =\n  // (1)\n  request.method === \u0027POST\u0027 \u0026\u0026\n  // (2)\n  request.headers.get(\u0027origin\u0027) !== url.origin \u0026\u0026\n  // (3)\n  is_form_content_type(request);\n\nif (forbidden) {\n  // (4)\n  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);\n  if (request.headers.get(\u0027accept\u0027) === \u0027application/json\u0027) {\n    return json(csrf_error.body, { status: csrf_error.status });\n  }\n  return text(csrf_error.body.message, { status: csrf_error.status });\n}\n```\nIf the incoming request specifies a POST method (1), the protection will compare the server\u2019s origin with the value of the HTTP `Origin` header (2). A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request\u2019s `Content-Type` header (3) whether the value is either `application/x-www-form-urlencoded` or `multipart/form-data` (`kit/src/utils/http.js#L71`). If all the previous checks pass, the request will be rejected with an 403 error response (4).\n\nThe `is_form_content_type` validation is not sufficient to mitigate all possible variations of this type of attack. If a CSRF attack is performed with the `Content-Type` header set to `text/plain`, the protection will be circumvented and the request will be processed by the endpoint handler.\n\u003c!--\n### PoC\nTo reproduce this issue, create and run a simple server (by default running on `localhost:3000`) with a POST endpoint handler such as:\n\n```js\nexport async function POST({ request }) {\n    const data = await request.json(); \n    console.log(JSON.stringify(data));\n    return new Response(String(\u0027success\u0027));\n}\n```\n\nNext, save the malicious HTML page:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003c/head\u003e\n\u003cbody\u003e\n  \u003ch1 id=\"name\"\u003e\u003c/h1\u003e\n  \u003cform action=\"http://localhost:3000/api/test\" method=\"POST\" enctype=\"text/plain\"\u003e\n    \u003cinput type=\"hidden\" name=\"\u0026#123;\u0026quot;name\u0026quot;\u0026#58;\u0026quot;test\" value=\"\u0026quot;\u0026#44;\u0026quot;age\u0026quot;\u0026#58;123\u0026#125;\" /\u003e\n    \u003cinput type=\"submit\" value=\"Submit\" /\u003e\n  \u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nin a file named `index.html`. Run another web server, using Python\u2019s built in http.server module (`python -m http.server`, by default running on `localhost:8000`), navigate to [http://localhost:8000/index.html](http://localhost:8000/index.html) and click the `Submit` button. \n\nVerify that the browser\u2019s URL has changed to `localhost:3000` and that the text `success` is displayed on the screen. Additionally, inspect the console of the SvelteKit web server and verify that the request body (`{\"name\":\"test=\",\"age\":123}`) was parsed as valid JSON and printed out. \n\nIt\u0027s worth noting that this attack is possible only for JSON request bodies. Form data sent using `text/plain` will be rejected by the server. \n--\u003e\n### Impact\n\nIf abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim\u0027s session, and in extreme scenarios can lead to unauthorized access to users\u2019 accounts.\n\n### Remediation\n\nSvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`.\n\nAs additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on PUT, PATCH and DELETE methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method=` override feature themselves in their `handle` hook, so that the request that `resolve` sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request.",
  "id": "GHSA-5p75-vc5g-8rv2",
  "modified": "2023-06-21T13:48:08Z",
  "published": "2023-04-04T21:20:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29003"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sveltejs/kit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SvelteKit vulnerable to Cross-Site Request Forgery"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-32929"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-22T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.",
  "id": "GHSA-5p79-2m8g-gf5w",
  "modified": "2022-05-04T00:00:36Z",
  "published": "2022-04-23T00:03:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32929"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-13T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its \u0027Delete comments easily\u0027, which could allow attackers to make logged in admin delete arbitrary comments",
  "id": "GHSA-5p8c-8g3r-93fc",
  "modified": "2022-05-24T19:14:18Z",
  "published": "2022-05-24T19:14:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24725"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/01483284-57f5-4ae9-b5f1-ae26b623571f"
    },
    {
      "type": "WEB",
      "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29225"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.checkmarx.jenkins:checkmarx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2022.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-25200"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-01T22:24:53Z",
    "nvd_published_at": "2022-02-15T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.",
  "id": "GHSA-5pcf-vxm3-frph",
  "modified": "2022-12-01T22:24:53Z",
  "published": "2022-02-16T00:01:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25200"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/checkmarx-plugin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/checkmarx-plugin/releases/tag/Release_2022.1.3"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/02/15/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials"
}