5603 matches found
EUVD-2026-60962
CSV export functionality in Brainstorm Force SureForms version, = 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the...
EUVD-2026-60798
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-75842
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-75842
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
EUVD-2026-60606
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-75842
ArcadeDB versions before 26.8.1 allow authenticated users with read query privileges to exploit the OpenCypher LOAD CSV clause's file:// protocol, reading arbitrary server files and exfiltrating data in query responses. CVSS 7.7 HIGH; no exploit code provided. Patch to 26.8.1.
CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
PT-2026-76942
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
python313-tablib-3.10.0-1.1 on GA media (moderate)
python313-tablib-3.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11533-1 Rating: moderate Cross-References: CVE-2026-9318 CVSS scores: CVE-2026-9318 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2026-9318 SUSE : 5.3...
PT-2026-77149
Name of the Vulnerable Software and Affected Versions Brainstorm Force SureForms versions prior to 2.12.2 Description The CSV export functionality fails to neutralize spreadsheet formula characters in user-controlled form field names before generating exports. This allows a remote attacker to...
BIT-PYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
BIT-LIBPYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
CVE-2026-15602
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-15602
CVE-2026-15602 affects the NEX-Forms – Ultimate Forms Plugin for WordPress up to version 9.2.4. The vulnerability is a generic SQL Injection via the additional_params parameter, due to insufficient escaping and poor query preparation. It is a second‑order issue: a payload is stored via the submis...
CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-59851
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-15602
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...