CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-3629

CVE-2026-3629 - वर्डप्रेस विशेषाधिकार वृद्धि जाँचकर्ता "Import and export users and customers" वर्डप्रेस प्लगइन में गंभीर विशेषाधिकार वृद्धि भेद्यता CVE-2026-3629 का पता लगाने के लिए एक कमांड-लाइन उपकरण। 📢 हमारे समुदाय से जुड़ें नवीनतम सुरक्षा उपकरणों, भेद्यताओं और हैकिंग तकनीकों के साथ अपडेट रहे...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

iTop-CVEs-exploit

iTop-CVEs-exploit يحتوي هذا المستودع على استغلالات لثغرات iTOP CVE-2024-52002 و52000 و31998 و31448 التي تتضمن سلسلة هجمات CSRF+XSS للحصول على صلاحيات إدارية على البرنامج. الإعداد 1. قم بتنزيل نسخة iTOP الضعيفة من docker root@kitploit: sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1...

import-users-from-csv-with-meta

import-users-from-csv-with-meta استيراد المستخدمين من CSV مع Meta 1.15 - تصدير غير مصرح به للمستخدمين المصادق عليهم...

BurpImportSitemap

إضافة Import To Sitemap Import To Sitemap هي إضافة Burp Suite لاستيراد ملف CSV من wstalker أو ملف تصدير من ZAP إلى خريطة موقع Burp. كما تتضمن قائمة سياقية لإرسال عناصر الطلبات/الاستجابات من أي تبويب إلى خريطة الموقع. الترخيص أُطلق كمصدر مفتوح بواسطة NCC Group Plc - https://www.nccgroup.com/ طُوّر...

CVE-2025-64027

معلومات المنتج Snipe-IT هو نظام إدارة أصول تكنولوجيا معلومات مجاني ومفتوح المصدر FOSS مبني على Laravel. يوفر تتبع الأجهزة، وإدارة تراخيص البرامج، وملحقات، وميزات جرد المواد الاستهلاكية لفرق عمليات تكنولوجيا المعلومات. يتم صيانته بنشاط وتحديثه بشكل متكرر. ملخص توجد ثغرة برمجة نصية عبر المواقع...

CVE-2025-9776

CVE-2025-9776: CatFolders WordPress प्लगइन में प्रमाणित SQL इंजेक्शन कीवर्ड: CVE-2025-9776, CatFolders WordPress भेद्यता, SQL इंजेक्शन WordPress, प्रमाणित SQL इंजेक्शन, WordPress सुरक्षा, CSV आयात भेद्यता, WordPress प्लगइन शोषण, CWE-89, WordPress डेटाबेस हमला, मीडिया लाइब्रेरी भेद्यता, WordPress...

EUVD-2026-43001

Snipe-IT's import createdby can be overwritten...

CVE-2026-81728 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

CVE-2026-81728

Dolibarr before 24.0.0 is affected by a SQL injection in its CSV/XLSX import wizard. The updatekeys parameter in htdocs/imports/import.php is filtered only by alphanohtml, which strips HTML but leaves SQL metacharacters intact. In import_insert() (import_csv.modules.php), submitted values are con...

CVE-2026-2334

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

EUVD-2026-63566

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-2334

vsDesk v14.0101 is affected by a missing server-side file extension validation in the "Import via CSV" component. An authenticated attacker with administrative privileges can bypass client-side validation to upload an arbitrary file, leading to Remote Code Execution (RCE) within the web applicati...

CVE-2026-49976

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-49976

Snipe-IT (IT asset/license management system) prior to 8.6.1 is vulnerable to account takeover via CSV import . A user with only the import permission can upload a CSV in update mode to overwrite a non-admin user's email address, then trigger a password reset to seize that account. The root cause...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

EUVD-2026-62675

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...