1945 matches found
CVE-2018-20468
CVE-2018-20468 affects Tyto Sahi Pro (versions up to 7.x.x and 8.0.0) where the web reports module’s export-to-Excel feature is vulnerable to CSV injection. An attacker can embed Excel formulas in an automation script, and after export, this can lead to code execution. The available documentation...
Joomla! 3.6.x < 3.9.7 Multiple Vulnerabilities
According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A CSV injection exists in versions 3.9.0 to 3.9.6 within the CSV export of comactionslogs - A cross-site scripting XSS vulnerability exists in versions 3.6.0 to 3.9.6 due to...
Joomla 3.6.x < 3.9.7 Multiple Vulnerabilites
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.6.x prior to 3.9.7. It is, therefore, affected by the following vulnerabilities: - Joomla versions 3.8.13 prior to 3.9.7 are affected by a vulnerability where a non-admin user may manipulate the...
Joomla! < 3.9.7 Multiple Vulnerabilities
Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-12765
An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...
CVE-2019-12765
An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...
CVE-2019-12765
CVE-2019-12765 affects Joomla! prior to 3.9.7. The issue is a CSV injection in the CSV export of the com_actionslogs component, caused by insufficient input validation during export. Public references (NVD/NIST, Nessus, OSV, CNVD, ENISA) confirm the vulnerability in Joomla! versions 3.9.0–3.9.6 (...
CVE-2019-12765
An issue was discovered in Joomla! before 3.9.7. The CSV export of comactionslogs is vulnerable to CSV injection...
WordPress Hustle – Pop-Ups, Slide-ins and Email Opt-ins plugin <= 6.0.7 - Unauthenticated CSV Injection vulnerability
Unauthenticated CSV Injection vulnerability found by Mark Parfeniuk in WordPress Hustle – Pop-Ups, Slide-ins and Email Opt-ins plugin versions = 6.0.7. Solution Update the WordPress Hustle – Pop-Ups, Slide-ins and Email Opt-ins plugin to the latest available version at least 6.0.8.1...
Design/Logic Flaw
CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...
CVE-2019-12134
CVE-2019-12134 describes a CSV/Formula injection in the Workday export feature. A value supplied by a low-privileged user in a contact form is mishandled during CSV export, potentially enabling Excel formula injection when opened in spreadsheet software. The connected documents confirm the vulner...
CVE-2019-12134
CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...
WordPress Hustle CSV Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Hustle a.k.a. wordpress-popup plugin is one of the online marketing plugins used in it. A CSV injection vulnerability exists in version...
Input validation
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
CVE-2019-11872
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
CVE-2019-11872
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
CVE-2019-11872
The Hustle (WordPress Hustle/wordpress-popup) plugin, version 6.0.7 for WordPress, is vulnerable to CSV Injection due to unsanitized user input in pop-ups. This can enable injection of malicious content into Excel, potentially allowing execution of code on an administrator’s machine. Documents co...
CVE-2019-11872
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
Hustle <= 6.0.7 - Unauthenticated CSV Injection
The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...