Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9236 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-7817 2 Michalaugustyniak, Misiek Photo Album 2 Misiek Photo Album, Misiek Photo Album 2024-09-27 6.5 Medium
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack
CVE-2024-8043 2 Seanschulte, Wordpress Plugin 2 Vikinghammer Tweet, Vikinghammer Tweet 2024-09-27 5.7 Medium
The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8051 2 Moc, Wordpress Plugin 2 Special Feed Items, Special Feed Items 2024-09-27 5.7 Medium
The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8091 2 Jakesnyder, Jupitercow 2 Enhanced Search Box, Enhanced Search Box 2024-09-27 4.8 Medium
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-8092 2 Alaingg, Alaingonzalez 2 Accordion Image Menu, Accordion Image Menu 2024-09-27 5.4 Medium
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8093 2 Lucas Garcia, Lucasgarcia 2 Posts Reminder, Posts Reminder 2024-09-27 4.8 Medium
The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-7820 2 Elliot, Ilc Thickbox 2 Ilc Thickbox, Ilc Thickbox 2024-09-27 4.3 Medium
The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-8052 2 Joen, Moc 2 Review Ratings, Review Ratings 2024-09-27 4.8 Medium
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-7816 2 Adeelraza, Gixaw Chat 2 Gixaw Chat, Gixaw Chat 2024-09-26 6.1 Medium
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-3163 2 Easy Property Listings, Realestateconnected 2 Easy Property Listings, Easy Property Listings 2024-09-26 4.3 Medium
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
CVE-2024-46086 1 Frogcms Project 1 Frogcms 2024-09-25 8.8 High
FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123
CVE-2024-46394 1 Frogcms Project 1 Frogcms 2024-09-25 8 High
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add
CVE-2024-6862 2 Lunary, Lunary-ai 2 Lunary, Lunary-ai\/lunary 2024-09-19 8.1 High
A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.
CVE-2024-39641 1 Thimpress 1 Learnpress 2024-09-18 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.
CVE-2024-39645 1 Themeum 1 Tutor Lms 2024-09-18 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
CVE-2024-39657 1 Sender 1 Sender 2024-09-18 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
CVE-2024-43116 1 10up 1 Simple Local Avatars 2024-09-18 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.
CVE-2024-6017 1 Scriptonite 1 Music Request Manager 2024-09-13 6.1 Medium
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-5203 2024-09-13 3.7 Low
After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.
CVE-2024-43325 1 Naiches 1 Dark Mode For Wp Dashboard 2024-09-12 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.