5374 matches found
CVE-2019-11872
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
CVE-2019-11872
The Hustle (WordPress Hustle/wordpress-popup) plugin, version 6.0.7 for WordPress, is vulnerable to CSV Injection due to unsanitized user input in pop-ups. This can enable injection of malicious content into Excel, potentially allowing execution of code on an administrator’s machine. Documents co...
CVE-2019-11872
The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...
TableField - Moderately critical - Access bypass and Cross Site Scripting - SA-CONTRIB-2019-051
This module allows you to attach tabular data to an entity. Access bypass There's no access check for users with an "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an attacker must ha...
Hustle <= 6.0.7 - Unauthenticated CSV Injection
The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...
May 23, 2019—KB4499182 (Preview of Monthly Rollup)
None None...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
Input validation
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel...
CVE-2018-7201
CVE-2018-7201 corresponds to a CSV Injection vulnerability in ProjectSend prior to version r1053. The issue arises when exporting/loading data for use in Microsoft Excel, enabling injection via CSV fields. Affected product: ProjectSend (before r1053). Root cause details are described only as a CS...
ProjectSend CVS Injection Vulnerability
rojectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A CVS injection vulnerability exists in versions prior to ProjectSend r1053 that affects victims who import data into Microsoft Excel...
WordPress FV Flowplayer Video Player plugin <= 7.3.14.727 - CSV Export vulnerability
CSV Export vulnerability found in WordPress FV Flowplayer Video Player plugin versions = 7.3.14.727. Solution Update the WordPress FV Flowplayer Video Player plugin to the latest available version at least 7.3.15.727...
FV Flowplayer Video Player <= 7.3.14.727 - CSV Export
Changelog states: Security - fix for email subscription CSV export capability available to guest users...
May 19, 2019—KB4505064 (OS Build 17134.766)
None None...
May 19, 2019—KB4505062 (OS Build 16299.1150)
None None...
May 19, 2019—KB4505056 (OS Build 17763.504)
None None...
May 19, 2019—KB4505051 (OS Build 10240.18218)
None None...
OpenEMR 5.0.1 Patch 6 SQLi Dump
This module exploits a SQLi vulnerability found in OpenEMR version 5.0.1 Patch 6 and lower. The vulnerability allows the contents of the entire database with exception of log and task tables to be extracted. This module saves each table as a .csv file in your loot directory and has been tested wi...