CWE-352 Cross-Site Request Forgery (CSRF)

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Contao: Cross-site request forgery in custom backend actions

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

Payara Server Full has a Cross-Site Request Forgery vulnerability

Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins Zowe zDevOps Plugin has a CSRF vulnerability

Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability

Jenkins Priority Sorter Plugin has a CSRF vulnerability

Jenkins Gitee Plugin has a cross-site request forgery vulnerability

Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Craft CMS has a potential information disclosure vulnerability in preview tokens

TYPO3 CMS - Broken Access Control in Backend and Install Tool