PT-2025-39705

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.12.1 Description The software is susceptible to Cross-Site Request Forgery CSRF due to inadequate nonce validation when exporting CSV files. This allows...

Formula Injection (CSV Injection)

unopim/unopim is vulnerable to Formula Injection CSV Injection. The vulnerability is due to malicious content inserted into a CSV file, which allows an attacker to exploit spreadsheet applications interpreting the input as formulas or commands instead of plain text...

CVE-2025-9776 CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import

The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

Missing Authorization

Overview typo3/cms-recordlist is a Lists database records in the TYPO3 backend module WebList. Affected versions of this package are vulnerable to Missing Authorization for the CSV download process. An attacker can access sensitive information from arbitrary database tables in the user's web...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization for the CSV download process. An attacker can access sensitive information from arbitrary database tables in the user's web mounts. Notes: - This vulnerability is limited to database records that fell within the pa...

CVE-2025-59019 Information Disclosure via CSV Download

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them...

CVE-2025-59019 Information Disclosure via CSV Download

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them...

TYPO3 CMS 安全漏洞

TYPO3 CMS is a content management system from TYPO3 open source. A security vulnerability exists in TYPO3 CMS versions 11.5.47 and earlier, 12.4.36 and earlier, and 13.4.17 and earlier, which stems from a lack of authorization checking in the CSV download function and could lead to database...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

Avigilon ACM 安全漏洞

Avigilon ACM is a physical access control system from Avigilon USA. A security vulnerability exists in Avigilon ACM version v7.10.0.20, which originates from CSV injection and could lead to the execution of arbitrary code...

Malicious code in csv-readable-exosphere-style-loader (npm)

The package csv-readable-exosphere-style-loader was found to contain malicious code...

CVE-2025-58855 WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V Artprima AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through = 1.4...

CVE-2025-58855 WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V Artprima AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through = 1.4...

WordPress plugin AP HoneyPot 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-36194

Name of the Vulnerable Software and Affected Versions: AP HoneyPot WordPress Plugin versions through 1.4 Description: The AP HoneyPot WordPress Plugin contains a flaw due to improper neutralization of formula elements in a CSV file, which can lead to reflected cross-site scripting XSS...

CVE-2025-39245

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data...

CVE-2025-39245

CVE-2025-39245 is a CSV injection vulnerability in Hikvision HikCentral Master Lite. The issue allows an attacker to inject executable commands via malicious CSV data, with CVSS v3.1 metrics indicating a Network attack vector, low attack complexity, no privileges required, user interaction requir...

CVE-2025-39245

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data...

Hikvision HikCentral Master Lite 安全漏洞

Hikvision HikCentral Master Lite is an AI Cloud-based application management intelligence platform for edge domains from Hikvision, China. A security vulnerability exists in Hikvision HikCentral Master Lite that originates from CSV injection and could lead to the execution of arbitrary commands...