On this page

CWE-352: Cross-Site Request Forgery (CSRF)

Weakness Summary

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

  • Canonical source: MITRE CWE-352
  • Published Atomicorp CVE observations: 50
  • Distinct affected products in those observations: 49
  • Active Atomicorp rules associated with this weakness: 84

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2022-1574WordPress HTML2WP <=1.0.0 - Arbitrary File Uploadhtml2wpProtected by Atomicorp rules382238
CVE-2026-53649Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEjoroProtected by Atomicorp rules340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2025-54782NestJS DevTools Integration - Remote Code Executiondevtools-integrationProtected by Atomicorp rules345240
CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding AttackrayProtected by Atomicorp rules340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2013-3568Linksys Devices pingstr Remote Command Injectionlinksys wrt110 firmwareProtected by Atomicorp rules330925
CVE-2016-4808Web2py 2.14.5 - Multiple Vulnerabilitiesweb2pyProtected by Atomicorp rules344360 , 344364 , 344366 , 344370
CVE-2016-6277NETGEAR Routers - Remote Code Executiond6220 firmwareProtected by Atomicorp rules347009
CVE-2017-9413Subsonic 6.1.1 - Server-Side Request ForgerysubsonicProtected by Atomicorp rules390726 , 392301 , 392647 , 392648
CVE-2017-9810Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilitiesanti-virus for linux serverProtected by Atomicorp rules390704 , 390724
CVE-2018-11442EasyService Billing 1.0 - Cross-Site Request Forgeryeasyservice billingProtected by Atomicorp rules340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147
CVE-2018-11445EasyService Billing 1.0 - Cross-Site Request Forgeryeasyservice billingProtected by Atomicorp rules340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147
CVE-2018-1213Dell EMC Isilon OneFS - Multiple Vulnerabilitiesemc isilon onefsProtected by Atomicorp rules330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585
CVE-2018-15884RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)mp c4504ex firmwareProtected by Atomicorp rules350147
CVE-2018-6224Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gatewayProtected by Atomicorp rules333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344360 , 344370 , 344372 , 346755 , 350147 , 380018 , 390572 , 390585 , 390704
CVE-2018-7700DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code ExecutiondedecmsProtected by Atomicorp rules344370
CVE-2020-5776MAGMI - Cross-Site Request ForgerymagmiProtected by Atomicorp rules344364 , 344366 , 344370 , 345490
CVE-2020-7991Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)frameworkProtected by Atomicorp rules340147 , 340148 , 342259 , 345490 , 345493 , 346755 , 350147 , 350148 , 398001
CVE-2021-25052WordPress Button Generator <2.3.3 - Remote File Inclusionbutton generatorProtected by Atomicorp rules340464 , 340465
CVE-2021-46398FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)filebrowserDetected by Atomicorp rules345490 , 345493
CVE-2022-0439Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injectionemail subscribers &amp; newslettersProtected by Atomicorp rules340016 , 377360 , 380122
CVE-2022-25241FileCloud 21.2 - Cross-Site Request Forgery (CSRF)filecloudDetected by Atomicorp rules345490
CVE-2022-28108Selenium Grid < 4.0.0-alpha-7 - Remote Code Executionselenium gridProtected by Atomicorp rules340095
CVE-2023-23897Ozette Plugins - Cross-Site Request Forgerysimple mobile url redirectDetected by Atomicorp rules345490 , 377360
CVE-2025-56798Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery VulnerabilityLime Technology, Inc.'s Unraid OS version 6.12.14 and earlierProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 393655
CVE-2026-60009theia Arbitrary Code Execution VulnerabilitytheiaProtected by Atomicorp rules351000
CVE-2026-73222Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio)claude-code-templatesProtected by Atomicorp rules340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-34228Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File WriteemlogProtected by Atomicorp rules340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655
CVE-2025-12061Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL ExecutionTAX SERVICE Electronic HDMProtected by Atomicorp rules340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370
CVE-2026-49471Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCEserenaProtected by Atomicorp rules340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2014-100005D-Link DIR-645 / DIR-815 diagnostic.php Command Executiondir-600 firmwareProtected by Atomicorp rules340014 , 340029 , 340193 , 344363 , 344364 , 344366 , 344370
CVE-2020-36836WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletionwp fastest cacheProtected by Atomicorp rules340748 , 347006 , 377360
CVE-2026-14234WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRFWOLFProtected by Atomicorp rules340087 , 340099 , 341099 , 341266 , 346755
CVE-2026-14239Tourmaster < 5.4.8 - Stored XSS via CSRFtourmasterProtected by Atomicorp rules333141 , 340087 , 340095 , 340099 , 340148 , 341099 , 341266 , 346755
CVE-2011-4452WikkaWiki 1.3.2 - Multiple VulnerabilitieswikkawikiProtected by Atomicorp rules331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647
CVE-2012-0286stoneware webnetwork6 - Multiple VulnerabilitieswebnetworkProtected by Atomicorp rules390726 , 392301 , 392647 , 392648
CVE-2012-5683ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password ResetzpanelProtected by Atomicorp rules340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704
CVE-2013-5696GLPI install.php Remote Command ExecutionglpiProtected by Atomicorp rules314144 , 344370
CVE-2014-0864IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limitsProtected by Atomicorp rules392301
CVE-2015-2755WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scriptingab google map travelProtected by Atomicorp rules346755 , 377360
CVE-2013-4865MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmwareProtected by Atomicorp rules330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647
CVE-2016-6897WordPress Traversal Directory DoSWordPressProtected by Atomicorp rules340748 , 344360 , 347006
CVE-2018-18760RhinOS CMS 3.x - Arbitrary File DownloadrhinosProtected by Atomicorp rules334168 , 344360
CVE-2018-7701SecurEnvoy SecurMail 9.1.501 - Multiple VulnerabilitiessecurmailProtected by Atomicorp rules330791 , 340152
CVE-2019-12616phpMyAdmin 4.8 - Cross-Site Request ForgeryphpmyadminProtected by Atomicorp rules390727 , 392301 , 392648
CVE-2020-8615Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgerytutor lmsDetected by Atomicorp rules345490 , 377360
CVE-2021-24947WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Readresponsive vector mapsProtected by Atomicorp rules344360 , 347009 , 390709
CVE-2025-47204Bootstrap Multiselect <= 1.1.2 - Cross-Site Scriptingbootstrap multiselectProtected by Atomicorp rules340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-89148AVideo Open Redirect via playlistSort.php Referer HeaderAVideoProtected by Atomicorp rules340162 , 340163 , 340165 , 344365
CVE-2011-4642Splunk Search Remote Code ExecutionsplunkProtected by Atomicorp rules340011 , 340087 , 340095 , 340128 , 346755 , 380018 , 390801
CVE-2022-29495WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgerypopup builderDetected by Atomicorp rules345490 , 377360

Associated Atomicorp WAF Rules

RuleStatusBehavior
314144Activedisruptive (deny)
330791Activedisruptive (deny)
330925Activedisruptive (deny)
331702Activedisruptive (deny)
333140Activedisruptive (deny)
333141Activedisruptive (deny)
334168Activedisruptive (deny)
337209Activedisruptive (deny)
337210Activedisruptive (deny)
337211Activedisruptive (deny)
340007Activedisruptive (deny)
340011Activedisruptive (deny)
340014Activedisruptive (deny)
340016Activedisruptive (deny)
340017Activedisruptive (deny)
340023Activedisruptive (deny)
340029Activedisruptive (deny)
340087Activedisruptive (deny)
340095Activedisruptive (deny)
340099Activedisruptive (deny)
340121Activedisruptive (deny)
340128Activedisruptive (deny)
340145Activedisruptive (deny)
340147Activedisruptive (deny)
340148Activedisruptive (deny)
340149Activedisruptive (deny)
340152Activedisruptive (deny)
340156Activedisruptive (deny)
340162Activedisruptive (deny)
340163Activedisruptive (deny)
340165Activedisruptive (deny)
340193Activedisruptive (deny)
340464Activedisruptive (deny)
340465Activedisruptive (deny)
340748Activedisruptive (deny)
341099Activedisruptive (deny)
341145Activedisruptive (deny)
341245Activedisruptive (deny)
341256Activedisruptive (deny)
341266Activedisruptive (deny)
342259Activedisruptive (deny)
344360Activedisruptive (deny)
344361Activedisruptive (deny)
344362Activedisruptive (deny)
344363Activedisruptive (deny)
344364Activedisruptive (deny)
344365Activedisruptive (deny)
344366Activedisruptive (deny)
344370Activedisruptive (deny)
344372Activedisruptive (deny)
345240Activedisruptive (deny)
345490Activedisruptive (deny)
345491Activenon-disruptive (pass)
345492Activenon-disruptive (pass)
345493Activenon-disruptive (pass)
346755Activedisruptive (deny)
347006Activedisruptive (deny)
347009Activedisruptive (deny)
350147Activedisruptive (deny)
350148Activedisruptive (deny)
351000Activedisruptive (deny)
360147Activedisruptive (deny)
360148Activedisruptive (deny)
360152Activedisruptive (deny)
377360Activenon-disruptive (pass)
380018Activedisruptive (deny)
380122Activedisruptive (deny)
382238Activedisruptive (deny)
390572Activedisruptive (deny)
390585Activedisruptive (deny)
390636Activedisruptive (deny)
390704Activedisruptive (deny)
390709Activedisruptive (deny)
390715Activedisruptive (deny)
390724Activedisruptive (deny)
390726Activedisruptive (deny)
390727Activedisruptive (deny)
390801Activedisruptive (deny)
390904Activedisruptive (deny)
392301Activedisruptive (deny)
392647Activedisruptive (deny)
392648Activedisruptive (deny)
393655Activedisruptive (deny)
398001Activenon-disruptive (pass)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-111 , CAPEC-462 , CAPEC-467 , CAPEC-62