CVE-2022-2240

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it...

CVE-2019-20385

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

CVE-2019-20385

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

Design/Logic Flaw

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

CVE-2019-20385

CVE-2019-20385 affects Logaritmo Aware CallManager 2012 devices. The vulnerability arises from the CSV upload feature in /supervisor/procesa_carga.php, which allows uploading of .php files with a text/* content type. The uploaded PHP code can then be executed by accessing /supervisor/csv/. Red Ha...

CVE-2019-20385

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

PT-2020-10412

Name of the Vulnerable Software and Affected Versions Logaritmo Aware CallManager 2012 Description The issue concerns the CSV upload feature in the /supervisor/procesa carga.php file, which allows the upload of .php files with a text/ content type. The uploaded PHP code can then be executed by...

CVE-2019-17114

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...

WordPress zx-csv-upload plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in version 1 of the WordPress zx-csv-upload plugin. The vulnerability ste...

CVE-2016-10943

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter...

Sql injection

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter...

CVE-2016-10943

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter...

CVE-2016-10943

CVE-2016-10943 affects the WordPress plugin zx-csv-upload (version 1). The vulnerability is an SQL injection through the id parameter in the plugin’s SQL queries, as documented across multiple sources (NVD entry, Red Hat advisory, CNVD/CVE listings, and WP vulnerability records). Exploitation is ...

CVE-2016-10943: Improper Neutralization of Special Elements used in an SQL Command

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter...

PT-2019-7736

Name of the Vulnerable Software and Affected Versions zx-csv-upload plugin version 1 for WordPress Description The issue concerns SQL injection via the id parameter. This allows for potential manipulation of database queries, which could lead to unauthorized data access or modification...

REDCap Cross Site Scripting

Exploit Title: REDCap - Details: Since it is an onkeypress event, it is triggered whenever the user touch any key and since the XSS payload is stored in the project name it appears in several pages. - Privileges: It requires admin privileges to store it. - Location example:...

REDCap 9.1.2 - Cross-Site Scripting

REDCap 9.1.2 - Cross-Site Scripting Exploit Title: REDCap - Details: Since it is an onkeypress event, it is triggered whenever the user touch any key and since the XSS payload is stored in the project name it appears in several pages. - Privileges: It requires admin privileges to store it. -...

REDCap < 9.1.2 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: REDCap - Details: Since it is an onkeypress event, it is triggered whenever the user touch any key and since the XSS payload is stored in the project name it appears in several pages. - Privileges: It requires admin privileges t...

CVE-2018-19514

In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file with a malicious payload that becomes part of a PHP eval...

PT-2019-9846

Name of the Vulnerable Software and Affected Versions Webgalamb versions prior to 7.0 Description The issue allows for arbitrary code execution, which can be exploited remotely without initial authentication. To exploit this, an attacker must bypass authentication to access administrative site...