CWE-352 跨站请求伪造(CSRF) 类弱点 5021 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-352 跨站请求伪造是一种身份验证缺陷漏洞,指应用未能充分验证请求是否由用户主动发起。攻击者通常通过诱导用户点击恶意链接或加载隐蔽图片,利用用户已登录的会话状态,以用户身份执行非预期的操作,如转账或修改密码。开发者可通过在请求中添加并验证唯一的 CSRF 令牌、检查 Referer 头以及使用 SameSite Cookie 属性来有效防御此类攻击。
<form action="/url/profile.php" method="post"> <input type="text" name="firstname"/> <input type="text" name="lastname"/> <br/> <input type="text" name="email"/> <input type="submit" name="submit" value="Update"/> </form>// initiate the session in order to validate sessions session_start(); //if the session is registered to a valid user then allow update if (! session_is_registered("username")) { echo "invalid session detected!"; // Redirect user to login page [...] exit; } // The user session is valid, so process the request // and update the information update_profile(); function update_profile { // read in the data from $POST and send an update // to the database SendUpdateToDatabase($_SESSION['username'], $_POST['email']); [...] echo "Your profile has been successfully updated."; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-2482 | IBM WebSphere Application Server Liberty 跨站请求伪造漏洞 — WebSphere Application Server - Liberty | 3.1 | Low | 2026-07-29 |
| CVE-2026-65947 | Gridbox < 2.20.2 后台管理界面跨站请求伪造漏洞 — Gridbox extension for Joomla | - | - | 2026-07-29 |
| CVE-2026-65944 | CSVI < 9.11.0 CSRF漏洞 — RO CSVI extension for Joomla | - | - | 2026-07-29 |
| CVE-2026-9720 | Facturación Electrónica Costa Rica <=2.0.2 插件设置跨站请求伪造漏洞 — Facturación Electrónica Costa Rica | 4.3 | Medium | 2026-07-29 |
| CVE-2026-47725 | Forgekeep nebula-mesh 跨站请求伪造漏洞 — nebula-mesh | 6.9 | Medium | 2026-07-28 |
| CVE-2026-15136 | WordPress WPLP Cookie Consent 跨站请求伪造漏洞 — WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | 4.3 | Medium | 2026-07-28 |
| CVE-2026-66474 | WordPress HT Script 跨站请求伪造漏洞 — Insert Headers and Footers Code – HT Script | 4.3 | Medium | 2026-07-27 |
| CVE-2026-66428 | WordPress WP Google Review Slider 跨站请求伪造漏洞 — WP Google Review Slider | 4.3 | Medium | 2026-07-27 |
| CVE-2026-15212 | WPO365 | LOGIN 跨站请求伪造漏洞 — WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 8.8 | High | 2026-07-23 |
| CVE-2026-57626 | WordPress MailPoet 跨站请求伪造漏洞 — MailPoet | 7.1 | High | 2026-07-23 |
| CVE-2026-65540 | WordPress Popup for CF7 with Sweet Alert 跨站请求伪造漏洞 — Popup for CF7 with Sweet Alert | 7.1 | High | 2026-07-23 |
| CVE-2026-65539 | WordPress Kwayy HTML Sitemap 跨站请求伪造漏洞 — Kwayy HTML Sitemap | 7.1 | High | 2026-07-23 |
| CVE-2026-65536 | WordPress persian-woocommerce-shipping 跨站请求伪造漏洞 — افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) | 6.5 | Medium | 2026-07-23 |
| CVE-2026-65512 | melapress wp activity log 跨站请求伪造漏洞 — WP Activity Log | 5.4 | Medium | 2026-07-23 |
| CVE-2026-65488 | WordPress LA-Studio Element Kit for Elementor 跨站请求伪造漏洞 — LA-Studio Element Kit for Elementor | 7.1 | High | 2026-07-23 |
| CVE-2026-65471 | ThemeFusion Avada 跨站请求伪造漏洞 — Avada Core | 9.6 | Critical | 2026-07-23 |
| CVE-2026-65464 | WordPress GiveWP 跨站请求伪造漏洞 — GiveWP | 5.4 | Medium | 2026-07-23 |
| CVE-2026-65460 | WordPress ZarinPal for WooCommerce 跨站请求伪造漏洞 — Zarinpal Gateway | 4.3 | Medium | 2026-07-23 |
| CVE-2026-61981 | quantumcloud Simple Link Directory Pro 跨站请求伪造漏洞 — Simple Link Directory Pro | 5.4 | Medium | 2026-07-23 |
| CVE-2026-57784 | Ninja Forms File Uploads Extension 跨站请求伪造漏洞 — Ninja Forms File Uploads Extension | 9.6 | Critical | 2026-07-23 |
| CVE-2026-57785 | ApusTheme ApusListing 跨站请求伪造漏洞 — ApusListing | 8.8 | High | 2026-07-23 |
| CVE-2026-24537 | WordPress WP Accessibility Helper (WAH) 跨站请求伪造漏洞 — WP Accessibility Helper (WAH) | 4.3 | Medium | 2026-07-23 |
| CVE-2026-64871 | Regular Labs Cache Cleaner extension for Joomla 权限许可和访问控制问题漏洞 — Cache Cleaner extension for Joomla | - | - | 2026-07-23 |
| CVE-2026-65757 | joomla Modules Anywhere 权限许可和访问控制问题漏洞 — Modules Anywhere extension for Joomla | - | - | 2026-07-23 |
| CVE-2026-64876 | joomla GeoIP 权限许可和访问控制问题漏洞 — GeoIP extension for Joomla | - | - | 2026-07-23 |
| CVE-2026-63265 | joomla Advanced Module Manager 权限许可和访问控制问题漏洞 — Advanced Module Manager extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-63280 | joomla Advanced Module Manager 权限许可和访问控制问题漏洞 — Advanced Module Manager extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-64791 | Regular Labs Extension Manager extension for Joomla 权限许可和访问控制问题漏洞 — Regular Labs Extension Manager extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-63684 | Joomla Content Templater 权限许可和访问控制问题漏洞 — Content Templater extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-64821 | thiagopena djangoSIGE 跨站请求伪造漏洞 — djangoSIGE | 4.3 | Medium | 2026-07-21 |
CWE-352(跨站请求伪造(CSRF)) 是常见的弱点类别,本平台收录该类弱点关联的 5021 条 CVE 漏洞。