Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-352 (跨站请求伪造(CSRF)) — Vulnerability Class 4773

4773 vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)). AI Chinese analysis included.

CWE-352, Cross-Site Request Forgery, is a web application weakness where the system fails to verify that an incoming request was intentionally initiated by the authenticated user rather than an unauthorized actor. Attackers typically exploit this vulnerability by tricking a victim into submitting a malicious request, often via a hidden link or form on a third-party site, while the victim is logged into the target application. Because the browser automatically includes valid session cookies, the server processes the forged request as legitimate, potentially allowing unauthorized actions like fund transfers or profile changes. Developers mitigate this risk by implementing anti-CSRF tokens, synchronizer tokens, or validating the Origin and Referer headers to ensure requests originate from trusted sources, thereby preventing unauthorized state changes.

MITRE CWE Description
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Common Consequences (1)
Confidentiality, Integrity, Availability, Non-Repudiation, Access ControlGain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data, DoS: Crash, Exit, or Restart
The consequences will vary depending on the nature of the functionality that is vulnerable to CSRF. An attacker could trick a client into making an unintentional request to the web server via a URL, image load, XMLHttpRequest, etc., which would then be treated as an authentic request from the client…
Mitigations (5)
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
ImplementationEnsure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and DesignGenerate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and DesignIdentify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and DesignUse the "double-submitted cookie" method as described by Felten and Zeller: When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the f…
Examples (1)
This example PHP code attempts to secure the form submission process by validating that the user submitting the form has a valid session. A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists.
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>
Bad · HTML
// initiate the session in order to validate sessions session_start(); //if the session is registered to a valid user then allow update if (! session_is_registered("username")) { echo "invalid session detected!"; // Redirect user to login page [...] exit; } // The user session is valid, so process the request // and update the information update_profile(); function update_profile { // read in the data from $POST and send an update // to the database SendUpdateToDatabase($_SESSION['username'], $_POST['email']); [...] echo "Your profile has been successfully updated."; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions — emlog--2026-05-08
CVE-2026-42190 RedwoodSDK: Same-site CSRF in in server actions — sdk 5.3 Medium2026-05-08
CVE-2026-5791 CSRF in DivvyDrive Information Technologies' DivvyDrive — DivvyDrive 9.6 Critical2026-05-07
CVE-2026-27415 WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability — BEAR 4.3 Medium2026-05-07
CVE-2025-68604 WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability — WPGraphQL 5.4 Medium2026-05-07
CVE-2026-41663 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send — admidio 3.5 Low2026-05-07
CVE-2026-40326 Masa CMS CSRF in site bundle creation allows unauthorized site data export — MasaCMS--2026-05-06
CVE-2026-40325 Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content — MasaCMS--2026-05-06
CVE-2026-40309 Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content — MasaCMS--2026-05-06
CVE-2026-40174 Masa CMS CSRF in user address management allows unauthorized address changes — MasaCMS--2026-05-06
CVE-2025-31957 HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. — BigFix Service Management (SM) 2.6 Low2026-05-06
CVE-2026-6702 Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter — Publish 2 Ping.fm 6.1 Medium2026-05-05
CVE-2026-6700 DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update — DX Sources 4.3 Medium2026-05-05
CVE-2026-6701 addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page — addfreespace 4.3 Medium2026-05-05
CVE-2026-42091 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS — goshs 6.5 Medium2026-05-04
CVE-2026-3140 Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation — Ultimate Dashboard – Custom WordPress Dashboard 4.3 Medium2026-05-01
CVE-2026-3772 WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor — WP Editor 8.8 High2026-05-01
CVE-2018-25310 VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution — VideoFlow Digital Video Protection 4.3 Medium2026-04-29
CVE-2018-25298 Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer — Merge PACS 5.3 Medium2026-04-29
CVE-2026-42645 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability — Barcode Scanner with Inventory & Order Manager 4.3 Medium2026-04-29
CVE-2026-7108 code-projects Invoice System in Laravel cross-site request forgery — Invoice System in Laravel 4.3 Medium2026-04-27
CVE-2026-41425 Authlib: Cross-site request forging when using cache — authlib 5.4 Medium2026-04-24
CVE-2026-3565 Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action — Taqnix 4.3 Medium2026-04-24
CVE-2026-41317 Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation — press 8.8AIHighAI2026-04-24
CVE-2026-27841 SenseLive X3050 Cross-Site request forgery — X3050 8.1 High2026-04-24
CVE-2026-41347 OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints — OpenClaw 7.1 High2026-04-23
CVE-2026-40471 Hackage CSRF vulnerability 9.6 Critical2026-04-23
CVE-2026-4922 Cross-Site Request Forgery (CSRF) in GitLab — GitLab 8.1 High2026-04-22
CVE-2025-58922 WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability — Avada 4.3 Medium2026-04-22
CVE-2026-4138 DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update — DX Unanswered Comments 4.3 Medium2026-04-22

Vulnerabilities classified as CWE-352 (跨站请求伪造(CSRF)) represent 4773 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.