CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2025-9776

CVE-2025-9776: Authenticated SQL Injection in CatFolders WordPress Plugin Keywords: CVE-2025-9776, CatFolders WordPress vulnerability, SQL injection WordPress, authenticated SQL injection, WordPress security, CSV import vulnerability, WordPress plugin exploit, CWE-89, WordPress database attack,...

CVE-2025-64027

Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...

CVE-2026-3629

CVE-2026-3629 - WordPress Privilege Escalation Checker A command-line tool to detect CVE-2026-3629 , a critical privilege escalation vulnerability in the "Import and export users and customers" WordPress plugin. 📢 Join Our Community Stay updated with the latest security tools, vulnerabilities, an...

CVE-2026-63194

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194 Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194

The bahmnicore OpenMRS module (used in Bahmni ) is vulnerable to a path traversal flaw in version 0.93 due to insufficient validation of input paths during the admin CSV import process. This vulnerability could lead to an arbitrary file write . The issue has been patched in version 0.93.1 . No sp...

CVE-2026-63194 Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194: Bahmni bahmni-core: OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients)

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

BurpImportSitemap

Import To Sitemap Extension Import To Sitemap is a Burp Suite Extension to import wstalker CSV file or ZAP export file into Burp Sitemap. It also includes a contextual menu to send request/response items from any tab to the sitemap. License Released as open source by NCC Group Plc -...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-115640

LimeSurvey Community Edition 7.7.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability within the Central Participants Database blocklist control. An authenticated user possessing the global participantpanel:import permission can import a CSV file where the participant_id contains ...

CVE-2026-118045

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role which does not have administrator privileges to delete arbitrary files on the server, such as...

CVE-2026-118045 Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role which does not have administrator privileges to delete arbitrary files on the server, such as...

CVE-2026-118045

The Ever Accounting WordPress plugin (versions before 2.3.3 ) contains an arbitrary file deletion vulnerability. The issue stems from the CSV import routine failing to restrict supplied file paths to an allowed directory. This allows users assigned the custom Accounting Manager role—who do not po...

EUVD-2026-117901

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role which does not have administrator privileges to delete arbitrary files on the server, such as...

CVE-2026-110692

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin (versions 2.10.0-3.1.2 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a lack of validation for user-supplied URLs before they are used in server-side HTTP requests, specifically duri...