PT-2026-97442

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.14 Description A reflected cross-site scripting issue exists on the administrative survey-participant CSV import result page. Reflected cross-site scripting occurs when an application includes untrusted...

CVE-2026-92730: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

forensic-timeliner

Высокоскоростной движок криминалистической обработки, созданный для специалистов DFIR. Быстрое объединение CSV-вывода от лучших инструментов триажа в единую мини-хронологию со встроенными фильтрацией, обнаружением артефактов, фильтрацией по датам, присвоением ключевых слов и дедупликацией. Релиз...

CVE-2026-91827

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

EUVD-2026-84283

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827

The Ninja Forms WordPress plugin (version 3.15.3 ) is vulnerable to unauthenticated PHP Object Injection . User-submitted form field values are deserialised without sanitisation when an administrator exports form submissions to CSV . Exploitation requires user interaction (an admin performing the...

PT-2026-96651

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attacke...

CVE-2026-91827: Deserialization of Untrusted Data

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-16542

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-92540

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) is vulnerable to privilege escalation . The software fails to correctly enforce the promote_users capability during a CSV import operation. This flaw allows users who only possess the create_users capability to by...

EUVD-2026-83677

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

EUVD-2026-83661

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

PT-2026-95930

Name of the Vulnerable Software and Affected Versions Import and export users and customers versions prior to 2.5.2 Description Insufficient enforcement of the promote users capability during CSV imports allows users who possess only the create users capability to create new administrator account...

PT-2026-95979

Name of the Vulnerable Software and Affected Versions 00Kisumi00 mcp-file-analyzer versions up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Description A path traversal issue exists in the analyze csv data MCP tool within the ControlFlowNode function of the main.py file. This occurs when the...

PT-2026-95914

Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.5 Description High-privileged users can perform Server-Side Request Forgery SSRF attacks during a CSV import. This occurs because the plugin fails to validate a...

CVE-2026-92540: Improper Privilege Management

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...