CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7 , is vulnerable to an unauthenticated PII disclosure . The root cause is a lack of authorization checks when exporting stored form submissions. This flaw allows unauthenticated attackers to download sensi...

EUVD-2026-96030

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-101947

The ExifTool for photo and video 5.0.1-gms by CellHubs is vulnerable to a Local OS command injection (CWE-78). The flaw exists in the CSV-export path because the application constructs shell command strings from file paths and invokes /system/bin/sh -c without properly escaping embedded single qu...

kev-data

Welcome to kev-data This repository is home to the data files that make up the Known Exploited Vulnerabilities KEV catalog. The data is originally sourced from https://www.cisa.gov/known-exploited-vulnerabilities-catalog, which is short linked at https://cisa.gov/kev. Interactive dashboard to...

Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

EUVD-2026-78645

Vikunja: Unbounded CSV row cardinality permits API process termination...

GHSA-PQF9-H8G4-8GMH Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

Security_Article

SecurityArticle scrapy website Article and link ... 0x01 Create a New Project 0x02 Define the Goal 0x03 Build the Spider 0x04 Store the Content e.g. pip3 install lxml,scrapy Article Title ArticleTitle //@id="wrapper"/main/div/article/header/h5/a/text //@id="wrapper"/main/div/article/header/h5/a...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - Unauthenticated SQL Injection Description The Navayan CSV Export plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

BurpImportSitemap

Import To Sitemap Extension Import To Sitemap is a Burp Suite Extension to import wstalker CSV file or ZAP export file into Burp Sitemap. It also includes a contextual menu to send request/response items from any tab to the sitemap. License Released as open source by NCC Group Plc -...

burp-reflux

Burp Proxy reflux log parser: Burp proxy text log converter to CSV and SQLLite Reflux for Burp log parsing and conversion Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit

CVE-2026-20245 - Cisco SD-WAN Privilege Escalation Exploit ⚠️ WARNING This code is ONLY for educational purposes and authorized security testing. 📋 Description CVE-2026-20245 is a privilege escalation vulnerability in the CLI of Cisco Catalyst SD-WAN Controller vSmart, Cisco Catalyst SD-WAN Manage...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

Password-Strength-Evaluator

Password Strength Evaluator Password Strength Evaluator is a tool to evaluate the strength of passwords and provide recommendations to improve their security. This tool also checks if your password has been exposed in any data breaches using the Have I Been Pwned API. Additionally, it stores the...

SearchIPOwner

SearchIPOwner - h3x0v3rl0rd - Example Usage: Single IP Query: python3 SearchIPOwner.py 8.8.8.8 Multiple IPs from a file: python3 SearchIPOwner.py iplist.txt Save to CSV: python3 SearchIPOwner.py iplist.txt -csv...

CVE-2022-44830

Suggested description Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Information Proof ...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...