Browse / Cross-Site Request Forgery

Cross-Site Request Forgery

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-Site Request Forgery (CSRF)530

Often found together with

• Cross-site Scripting148
• Authentication79
• Misconfiguration70
• Access Control61
• Information Disclosure61

Most upvoted Cross-Site Request Forgery reports

AllValidInformativeN/ADuplicate

1. [CSRF] TikTok Careers Portal Account TakeoverCross-Site Request Forgery (CSRF) · high · TikTok
   366 votes
2. CSRF on connecting Paypal as Payment ProviderCross-Site Request Forgery (CSRF) · medium · Shopify
   304 votes
3. Account Takeover using Linked Accounts due to lack of CSRF protectionCross-Site Request Forgery (CSRF) · high · Rockstar Games
   238 votes
4. Periscope android app deeplink leads to CSRF in follow actionCross-Site Request Forgery (CSRF) · low · X / xAI
   $1,540224 votes
5. Take over of accounts created using Google or FacebookCross-Site Request Forgery (CSRF) · critical · Khan Academy
   184 votes
6. Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneCross-Site Request Forgery (CSRF) · high · HackerOne
   168 votes
7. Site wide CSRF affecting both job seeker and Employer account on glassdoor.comCross-Site Request Forgery (CSRF) · Glassdoor
   162 votes
8. CSRF protection bypass in GitHub Enterprise management consoleCross-Site Request Forgery (CSRF) · high · GitHub
   $10,000152 votes
9. Slack integration setup lacks CSRF protectionCross-Site Request Forgery (CSRF) · high · HackerOne
   $2,500149 votes
10. SocialClub Account Take Over Through Import Friends featureCross-Site Request Forgery (CSRF) · high · Rockstar Games
    116 votes
11. CSRF token validation system is disabled on Stripe DashboardCross-Site Request Forgery (CSRF) · medium · Stripe
    113 votes
12. Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Cross-Site Request Forgery (CSRF) · medium · Rockstar Games
    112 votes
13. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) · high · ownCloud
    111 votes
14. Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversCross-Site Request Forgery (CSRF) · high · Khan Academy
    111 votes
15. CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Cross-Site Request Forgery (CSRF) · medium · Rockstar Games
    104 votes
16. Account takeover due to insufficient URL validation on RelayState parameterCross-Site Request Forgery (CSRF) · medium · GitLab
    $2,45099 votes
17. One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comCross-Site Request Forgery (CSRF) · medium · Logitech
    99 votes
18. CSRF Account TakeoverCross-Site Request Forgery (CSRF) · high · TikTok
    95 votes
19. CSRF to HTML Injection in CommentsCross-Site Request Forgery (CSRF) · high · WordPress
    95 votes
20. CSRF in Account Deletion feature (https://www.flickr.com/account/delete)Cross-Site Request Forgery (CSRF) · high · Flickr
    92 votes
21. Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountCross-Site Request Forgery (CSRF) · high · Discourse
    89 votes
22. CSRF on /api/graphql allows executing mutations through GET requestsCross-Site Request Forgery (CSRF) · high · GitLab
    $3,37088 votes
23. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF) · high · X / xAI
    88 votes
24. CSRF leads to Account takeoverCross-Site Request Forgery (CSRF) · high · U.S. Dept Of Defense
    87 votes
25. CSRF token validation system is disabled on Stripe DashboardCross-Site Request Forgery (CSRF) · medium · Stripe
    $2,50087 votes
26. Login CSRF vulnerability on hackerone.comCross-Site Request Forgery (CSRF) · low · HackerOne
    $50084 votes
27. Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)Cross-Site Request Forgery (CSRF) · low · Acronis
    82 votes
28. XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimCross-Site Request Forgery (CSRF) · medium · PayPal
    $3,50081 votes
29. CSRF in ticket functionCross-Site Request Forgery (CSRF) · medium · TikTok
    80 votes
30. Account takeover by changing emailCross-Site Request Forgery (CSRF) · critical · Khan Academy
    80 votes
31. CSRF protection bypass on TikTok Webcast EndpointsCross-Site Request Forgery (CSRF) · medium · TikTok
    $2,50079 votes
32. CSRF protection on OIDC login is brokenCross-Site Request Forgery (CSRF) · medium · Nextcloud
    $50077 votes
33. Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using ChromeCross-Site Request Forgery (CSRF) · high · Starbucks
    77 votes
34. CSRF on Periscope Web OAuth authorization endpoint Cross-Site Request Forgery (CSRF) · X / xAI
    74 votes
35. Changing paymentProfileUuid when booking a trip allows free ridesCross-Site Request Forgery (CSRF) · Uber
    73 votes
36. Facebook OAuth Code Theft through referer leakage on support.rockstargames.comCross-Site Request Forgery (CSRF) · medium · Rockstar Games
    71 votes
37. CSRF to change passwordCross-Site Request Forgery (CSRF) · Nord Security
    71 votes
38. CSRF vulnerability allows disabling Gmail contacts link for user referralsCross-Site Request Forgery (CSRF) · medium · Insightly
    70 votes
39. CSRF protection bypass on any Django powered site via Google AnalyticsCross-Site Request Forgery (CSRF) · Django
    70 votes
40. CSRF leads to Account takeoverCross-Site Request Forgery (CSRF) · high · U.S. Dept Of Defense
    67 votes
41. csrftoken not unique to session or specific user and csrfmiddlewaretoken can be alteredCross-Site Request Forgery (CSRF) · low · Mozilla
    $50063 votes
42. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF) · Bumble
    63 votes
43. Client-Side Path Traversal on LINE Developers ConsoleCross-Site Request Forgery (CSRF) · medium · LY Corporation
    61 votes
44. CSRF to delete a pet on ██████Cross-Site Request Forgery (CSRF) · low · Mars
    61 votes
45. Revocation API Token by Bypassing The XSRF TokenCross-Site Request Forgery (CSRF) · critical · Enjin
    60 votes
46. [Admin Panel] CSRF to resume/pause runnerCross-Site Request Forgery (CSRF) · low · GitLab
    60 votes
47. CSRF at Network featureCross-Site Request Forgery (CSRF) · medium · Lichess
    59 votes
48. CSRF Trial 14 days express subscriptionCross-Site Request Forgery (CSRF) · Instacart
    59 votes
49. Periscope iOS app CSRF in follow action due to deeplinkCross-Site Request Forgery (CSRF) · low · X / xAI
    $2,94058 votes
50. CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)Cross-Site Request Forgery (CSRF) · low · Discourse
    58 votes
51. [tanks.mail.ru] SSRF + Кража cookie Cross-Site Request Forgery (CSRF) · Mail.ru
    $75055 votes
52. Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.comDuplicateCross-Site Request Forgery (CSRF) · high · Ubiquiti Inc.
    55 votes
53. authenticity token not verfied leads to change business nameCross-Site Request Forgery (CSRF) · medium · Shopify
    $1,90054 votes
54. CSRF allowing unauthorized modification of user Notes on ███████Cross-Site Request Forgery (CSRF) · low · Tucows (VDP)
    53 votes
55. CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*Cross-Site Request Forgery (CSRF) · medium · LinkedIn
    53 votes
56. CSRF combined with IDOR within Document Converter exposes filesCross-Site Request Forgery (CSRF) · Open-Xchange
    $50052 votes
57. [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Cross-Site Request Forgery (CSRF) · critical · Uber
    $2,00050 votes
58. CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]Cross-Site Request Forgery (CSRF) · medium · Logitech
    49 votes
59. apps.shopify.com - CSRF token leakage through Google AnalyticsCross-Site Request Forgery (CSRF) · Shopify
    48 votes
60. CSRF Attack on changing security questions leads to full Account TakeOverCross-Site Request Forgery (CSRF) · high · U.S. Dept Of Defense
    47 votes
61. CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !Cross-Site Request Forgery (CSRF) · medium · Reddit
    47 votes
62. CSRF leads to account deactivation of usersCross-Site Request Forgery (CSRF) · medium · Evernote
    $30044 votes
63. CSRF on launchpad.37signals.com OAuth2 authorization endpointCross-Site Request Forgery (CSRF) · high · Basecamp
    44 votes
64. Cross-site request forgery vulnerability resulting in the deletion of a user's account.Cross-Site Request Forgery (CSRF) · ██████
    44 votes
65. Account takeover through CSRF in http://███████/██████████/default.aspCross-Site Request Forgery (CSRF) · high · U.S. Dept Of Defense
    42 votes
66. CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login Cross-Site Request Forgery (CSRF) · medium · TikTok
    41 votes
67. CSRF that makes any user send invitations to the attacker by simply clicking on a link.Cross-Site Request Forgery (CSRF) · medium · LinkedIn
    41 votes
68. Path traversal leading to limited CSRF on GET requests on two endpointsCross-Site Request Forgery (CSRF) · HackerOne
    41 votes
69. CSRF on cards APICross-Site Request Forgery (CSRF) · X / xAI
    41 votes
70. CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'Cross-Site Request Forgery (CSRF) · medium · Rockstar Games
    40 votes
71. CSRF to Information disclosure on password resetCross-Site Request Forgery (CSRF) · low · Mozilla
    39 votes
72. CSRF To Add New App In Developer Account And Bypassing Json FormatCross-Site Request Forgery (CSRF) · medium · TikTok
    $20039 votes
73. <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->Cross-Site Request Forgery (CSRF) · critical · Rockstar Games
    39 votes
74. There is a POST based CSRF issue over IBM endpoint leading to modification of contact information. Cross-Site Request Forgery (CSRF) · medium · IBM
    38 votes
75. CSRF on api.my.games due to improper validation of token allows an attacker to delete other users notificationsCross-Site Request Forgery (CSRF) · Mail.ru
    $10038 votes
76. CSRF Vulnerability at https://aw.my.com/Cross-Site Request Forgery (CSRF) · Mail.ru
    38 votes
77. CSRF in Changing User Verification EmailCross-Site Request Forgery (CSRF) · low · TikTok
    $50037 votes
78. (BYPASS) Open redirect and XSS in supporthiring.shopify.comCross-Site Request Forgery (CSRF) · Shopify
    37 votes
79. monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)Cross-Site Request Forgery (CSRF) · low · Kubernetes
    $10036 votes
80. HackerOne reports escalation to JIRA is CSRF vulnerableCross-Site Request Forgery (CSRF) · medium · HackerOne
    $50036 votes
81. Attacker could setup reminder remotely using brute forceN/ACross-Site Request Forgery (CSRF) · Uber
    36 votes
82. CSRF in AppSearch allows creation of "curations"Cross-Site Request Forgery (CSRF) · medium · Elastic
    35 votes
83. CSRF on https://www.niche.co leads to "account disconnection"DuplicateCross-Site Request Forgery (CSRF) · medium · X / xAI
    35 votes
84. Firmware download/install vulnerable to CSRFCross-Site Request Forgery (CSRF) · high · Ubiquiti Inc.
    35 votes
85. Argo CD CSRF leads to Kubernetes cluster compromiseCross-Site Request Forgery (CSRF) · high · Internet Bug Bounty
    $4,66034 votes
86. [h1-2102] Wholesale - CSRF to Generate Invitation Token for a Customer and Move Customer to Invited StatusCross-Site Request Forgery (CSRF) · low · Shopify
    34 votes
87. Disable 2FA via CSRF (Leads to 2FA Bypass)Cross-Site Request Forgery (CSRF) · Mail.ru
    34 votes
88. Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's hostCross-Site Request Forgery (CSRF) · medium · GSA Bounty
    34 votes
89. JSON CSRF on POST Heartbeats APICross-Site Request Forgery (CSRF) · medium · WakaTime
    34 votes
90. CSRF Attack leads to delete album atCross-Site Request Forgery (CSRF) · medium · U.S. Dept Of Defense
    33 votes
91. Account takeover through multistage CSRF at https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer and ../AutoChoice/changePwOktaAnswerCross-Site Request Forgery (CSRF) · medium · U.S. General Services Administration
    33 votes
92. Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)Cross-Site Request Forgery (CSRF) · medium · CS Money
    $30033 votes
93. Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]Cross-Site Request Forgery (CSRF) · medium · Unikrn
    33 votes
94. Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) · Instacart
    33 votes
95. Make API calls on behalf of another user (CSRF protection bypass)Cross-Site Request Forgery (CSRF) · Vimeo
    33 votes
96. CSRF in Delete Pet FunctionCross-Site Request Forgery (CSRF) · medium · Mars
    32 votes
97. gifts.flocktory.com/phpmyadmin is vulnerable csrfCross-Site Request Forgery (CSRF) · QIWI
    32 votes
98. Site-wide CSRF at Atavist Cross-Site Request Forgery (CSRF) · high · Automattic
    32 votes
99. OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingCross-Site Request Forgery (CSRF) · Vimeo
    32 votes
100. CSRF to XSSCross-Site Request Forgery (CSRF) · medium · U.S. Dept Of Defense
     31 votes