Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9892 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6499 1 Calenfretts 1 Lastunes 2025-05-06 5.4 Medium
The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2022-3419 1 Addify 1 Automatic User Roles Switcher 2025-05-06 6.5 Medium
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
CVE-2022-40291 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 8.8 High
The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.
CVE-2024-13118 1 Brijeshk89 1 Ip Based Login 2025-05-06 4.3 Medium
The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
CVE-2022-40488 1 Processwire 1 Processwire 2025-05-06 6.5 Medium
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).
CVE-2018-6336 1 Linuxfoundation 1 Osquery 2025-05-06 7.8 High
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7
CVE-2024-24843 1 Powerpackelements 1 Powerpack Addons For Elementor 2025-05-06 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8.
CVE-2024-24849 1 Developingtheweb 1 Quicksand Post Filter Jquery 2025-05-06 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
CVE-2024-24876 1 W-shadow 1 Admin Menu Editor 2025-05-06 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.
CVE-2024-25904 1 Blackbam 1 Tinymce And Tinymce Advanced Professsional Formats And Styles 2025-05-06 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.
CVE-2024-24798 1 Soninow 1 Debug 2025-05-06 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10.
CVE-2024-24802 1 Jtrt Responsive Tables Project 1 Jtrt Responsive Tables 2025-05-06 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9.
CVE-2024-5076 1 Tipsandtricks-hq 1 Wp Emember 2025-05-06 8.8 High
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-5077 1 Tipsandtricks-hq 1 Wp Emember 2025-05-06 6.8 Medium
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-13826 1 Intricateweb 1 Email Keep 2025-05-06 5.4 Medium
The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-42764 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 9.4 Critical
Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
CVE-2022-2387 1 Awesomemotive 1 Easy Digital Downloads 2025-05-05 4.3 Medium
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
CVE-2021-28656 1 Apache 1 Zeppelin 2025-05-05 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
CVE-2024-0779 1 Mediabetaprojects 1 Enjoy Social Feed 2025-05-05 8.8 High
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example
CVE-2024-0858 1 Theinnovs 1 Innovs Hr 2025-05-05 8.8 High
The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.