5357 matches found
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
EUVD-2026-52745
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255
Flowise CVE-2026-69255 affects the CSVAgent component (packages/components/nodes/agents/CSVAgent/CSVAgent.ts) prior to version 3.1.3. The vulnerability stems from attacker-controlled CSV data being interpolated into a Python block via base64String = "${base64String}" after naively parsing CSV wit...
EUVD-2026-52693
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-67196
Vulnerability : In Perspective 5.0.0, the built-in Debug plugin is vulnerable to cross-site scripting via innerHTML interpolation during CSV serialization. Trigger : attackers craft table rows whose cells contain unescaped HTML markup, including unquoted event-handler attributes, which are not es...
CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-18738
Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...
CVE-2026-18738
Shlink 5.0.0–5.1.5 is affected by a CSV formula injection via visit export (CLI). An unauthenticated attacker can send a single request with malicious values in headers (User-Agent, Referer, or request path) that start with =, +, -, or @, causing embedded DDE/WEBSERVICE payloads in CSV cells. Whe...
CVE-2026-16534
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...
CVE-2025-15673
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...
CVE-2025-15673
The CVE-2025-15673 entry affects the WordPress Import and Export Users and Customers plugin up to version 2.4.3. The root cause is an insufficiently restricted file path when reading and displaying files during CSV imports, enabling a high-privilege user to read arbitrary server files. This impac...
CVE-2025-15673 Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...
Malicious code in fast-csv-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...
MAL-2026-11462 Malicious code in fast-csv-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...
Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances...