CSRF attacks are very real, but the impact is generally taken into account before calling things a &quot;vulnerability&quot;.<p>e.g you can have a SQL injection that&#x27;s not a vulnerability because the input passes through a substr($_GET[&quot;id&quot;],1,1).