CVE-2022-23409: Improper Limitation of a Pathname to a Restricted Directory

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

Ethercreative Logs 3.0.3 Path Traversal

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Path Traversal product: Ethercreative Logs plugin for Craft CMS vulnerable version: =3.0.4 CVE number: CVE-2022-23409 impact: Medium homepage:...

Pixel＆tonic Craft CMS 路径遍历漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic. A path traversal vulnerability exists in Pixel & tonic Craft CMS, which stems from a path traversal security issue in the Ethercreative Logs plugin for Craft CMS...

Ethercreative Logs 3.0.3 Path Traversal Vulnerability

======================================================================= title: Authenticated Path Traversal product: Ethercreative Logs plugin for Craft CMS vulnerable version: =3.0.4 CVE number: CVE-2022-23409 impact: Medium homepage: https://github.com/ethercreative/logs found: 2021-07-06 by:...

CSV injection in Craft CMS

Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...

GHSA-XRPJ-F9V6-2332 CSV injection in Craft CMS

Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

Design/Logic Flaw

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before version 3.7.14 is vulnerable to CSV injection via export functionality. The root cause is lack of input sanitization/escaping when exporting data to CSV, allowing crafted input to trigger payloads in CSV readers (e.g., Excel). Affected software is Craft CMS (core) with CSV export...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824: Improper Neutralization of Formula Elements in a CSV File

Craft CMS before 3.7.14 allows CSV injection...

PT-2021-23419

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 3.7.14 Description The issue allows CSV injection, which can trigger a payload in old versions of Excel under certain circumstances. This can occur when exporting data in CSV format from element index pages,...

Craft CMS Remote Code Injection

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...

GHSA-X2J7-6HXM-87P3 Craft CMS Remote Code Injection

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...

Craft CMS Cross-site Scripting Vulnerability

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

GHSA-3JXH-789F-P7M6 Craft CMS Cross-site Scripting Vulnerability

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2021-46873)

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...