Browse / Cross-Site Request Forgery

Cross-Site Request Forgery

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-Site Request Forgery (CSRF)530

Often found together with

• Cross-site Scripting148
• Authentication79
• Misconfiguration70
• Access Control61
• Information Disclosure61

Most upvoted Cross-Site Request Forgery reports

AllValidInformativeN/ADuplicate

1. HackerOne is still prone to Internet Explorer UXSSInformativeCross-Site Request Forgery (CSRF) · HackerOne
   23 votes
2. CSRF in Udemy.com InformativeCross-Site Request Forgery (CSRF) · Udemy
   11 votes
3. Non-changing "_idnonce" value leads to CSRF on accounts at https://intensedebate.com for account takeoverInformativeCross-Site Request Forgery (CSRF) · low · Automattic
   8 votes
4. csrf token did not changed after login/logout many timesInformativeCross-Site Request Forgery (CSRF) · Liberapay
   8 votes
5. Server Side Request Forgery In Video to GIF FunctionalityInformativeCross-Site Request Forgery (CSRF) · Imgur
   8 votes
6. Logout page does not prevent CSRFInformativeCross-Site Request Forgery (CSRF) · low · Courier
   6 votes
7. Order-phishing via Payment ID URLInformativeCross-Site Request Forgery (CSRF) · low · PortSwigger Web Security
   6 votes
8. CSRF token leakageInformativeCross-Site Request Forgery (CSRF) · Enter
   6 votes
9. Vulnerable W3 Total Cache plugin version in use on nextcloud.comInformativeCross-Site Request Forgery (CSRF) · medium · Nextcloud
   5 votes
10. CSRF to make any user accept the invitation to the teamInformativeCross-Site Request Forgery (CSRF) · Liberapay
    5 votes
11. CSRF csrftoken in cookiesInformativeCross-Site Request Forgery (CSRF) · high · Gratipay
    5 votes
12. Unauthenticated CSRF(User can input any value for CSRF Token)InformativeCross-Site Request Forgery (CSRF) · Veris
    5 votes
13. Missing CSRF Protection in /stats EndPoint.InformativeCross-Site Request Forgery (CSRF) · Chaturbate
    4 votes
14. CSRF bypassInformativeCross-Site Request Forgery (CSRF) · Vimeo
    4 votes
15. Notifications can mark as read by CSRFInformativeCross-Site Request Forgery (CSRF) · X / xAI
    4 votes
16. HTML form without CSRF protectionInformativeCross-Site Request Forgery (CSRF) · Automattic
    4 votes
17. Unwanted Spamming Using CSRF [LOGGED IN USER]InformativeCross-Site Request Forgery (CSRF) · IRCCloud
    4 votes
18. CSRF - Adding/Removing items to cart - shop.khanacademy.orgInformativeCross-Site Request Forgery (CSRF) · Khan Academy
    4 votes
19. Authenticity token doesnt expire after single use leading to CSRFInformativeCross-Site Request Forgery (CSRF) · Omise
    3 votes
20. CSRF token manipulation in every possible form submits. NO server side ValidationInformativeCross-Site Request Forgery (CSRF) · Liberapay
    3 votes
21. CSRF ON EDITING NAME (OPTIONAL)InformativeCross-Site Request Forgery (CSRF) · Liberapay
    3 votes
22. Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’sInformativeCross-Site Request Forgery (CSRF) · Liberapay
    3 votes
23. The contribution save option seem to be vulnerable to CSRFInformativeCross-Site Request Forgery (CSRF) · Gratipay
    3 votes
24. Newsroom.uber HTML form without CSRF protectionInformativeCross-Site Request Forgery (CSRF) · Uber
    3 votes
25. Csrf on creating courseInformativeCross-Site Request Forgery (CSRF) · Udemy
    3 votes
26. HTML Form Without CSRF Protection VulnerabilityInformativeCross-Site Request Forgery (CSRF) · Uzbey
    3 votes
27. Csrf bug on signup sessionInformativeCross-Site Request Forgery (CSRF) · Coinbase
    2 votes
28. CSRF token validation is missingInformativeCross-Site Request Forgery (CSRF) · medium · Nextcloud
    2 votes
29. CSRF with redeem coupon request InformativeCross-Site Request Forgery (CSRF) · Instacart
    2 votes
30. Lost Password CSRFInformativeCross-Site Request Forgery (CSRF) · Nextcloud
    2 votes
31. csrf_token cookie don't have the flag "HttpOnly"InformativeCross-Site Request Forgery (CSRF) · Gratipay
    2 votes
32. CSRF token from another valid user session acceptedInformativeCross-Site Request Forgery (CSRF) · Mobile Vikings
    2 votes
33. CRLF InjectionInformativeCross-Site Request Forgery (CSRF) · Khan Academy
    2 votes
34. CSRF - Disabling orders at https://panel.stopthehacker.com/manage/disable-order/order/IDInformativeCross-Site Request Forgery (CSRF) · StopTheHacker
    2 votes
35. CSRF token valid even after the session logout of a particular userInformativeCross-Site Request Forgery (CSRF) · Phabricator
    2 votes
36. CSRF TokenInformativeCross-Site Request Forgery (CSRF) · Udemy
    1 votes
37. CSRF Token Design FlawInformativeCross-Site Request Forgery (CSRF) · Udemy
    1 votes
38. The websocket traffic is not secure enoughInformativeCross-Site Request Forgery (CSRF) · medium · Legal Robot
    1 votes
39. Udemy s3 storage can be used by an attacker personal website because of missing CSRF TokenInformativeCross-Site Request Forgery (CSRF) · Udemy
    1 votes
40. Lack of CSRF token validation at server sideInformativeCross-Site Request Forgery (CSRF) · Gratipay
    1 votes
41. The Anti-CSRF Library fails to restrict token to a particular IP address when being behind a reverse-proxy/WAFInformativeCross-Site Request Forgery (CSRF) · Paragon Initiative Enterprises
    1 votes
42. Cross site request forgeryInformativeCross-Site Request Forgery (CSRF) · Hiro
43. self cross site scriptingInformativeCross-Site Request Forgery (CSRF) · low · Gratipay
44. CSRF IssueInformativeCross-Site Request Forgery (CSRF) · Legal Robot