Search Meter < 2.13.3 - CSV Injection

A CSV Injection vulnerability was discovered in the Search Meter WordPress plugin. Version 2.13.2 and possibly earlier versions of the plugin was found to be affected. According to the reporter, the issue was reported to the plugin's author but they did not respond...

Wordpress Search Meter 2.13.2 Plugin - CSV injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Search Meter 2.13.2 - CSV Injection Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://thunderguy.com/semicolon/ Software Link: https://downloads.wordpress.org/plugin/search-meter.2.13.2.zip Version...

Joomla! 3.9.0 < 3.9.7 - CSV Injection

!/usr/bin/python3 Exploit Title: Joomla 3.9.0 ' printf'Example: sys.argv0 http://127.0.0.1 ' sys.exit1 baseurl = sys.argv1 regurl = f"baseurl/joomla/index.php/component/users/?view=registration&Itemid=101" loginurl = f"baseurl/joomla/index.php?option=comusers" def pwnusername='abdullah': payload ...

CVE-2020-9372

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input in fields such as Description or Name in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve...

Input validation

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input in fields such as Description or Name in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve...

CVE-2020-9372

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input in fields such as Description or Name in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve...

CVE-2020-9372

The CVE affects the WordPress plugin Appointment Booking Calendar prior to version 1.3.35. The vulnerability allows any user-supplied input in booking form fields (e.g., Description or Name) to be treated as a formula and exported via the CSV export in the admin bookings list, enabling remote cod...

Appointment Booking Calendar < 1.3.35 - CSV Injection

The Appointment Booking Calendar WordPress plugin was affected by a CSV Injection security vulnerability...

CVE-2020-9466

The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...

Design/Logic Flaw

The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...

CVE-2020-9466

The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...

CVE-2020-9466

CVE-2020-9466 affects the WordPress plugin Export Users to CSV (≤1.4.2). An attacker who can register as a subscriber can inject CSV payloads into user-details fields; when an authenticated admin exports user data to CSV and opens it, the payload can execute (e.g., redirections to malicious sites...

LiteCart CSV Injection Vulnerability

LiteCart is a lightweight e-commerce platform for online merchants developed using PHP, HTML 5 and CSS 3. A CSV injection vulnerability exists in LiteCart 2.2.1 and earlier versions. An attacker can exploit the vulnerability to execute code via a customer's profile...

WordPress Export Users to CSV plugin <= 1.4.2 - CSV Injection vulnerability

CSV Injection vulnerability found by Jinson Varghese Behanan in WordPress Export Users to CSV plugin versions = 1.4.2. Solution 2020 Feb. 26 - no patched version available...

Export Users to CSV <= 1.4.2 - CSV Injection

An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...

Export Users to CSV <= 1.4.2 - CSV Injection

An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...

CVE-2020-9017

LiteCart through 2.2.1 allows CSV injection via a customer's profile...

CVE-2020-9017

LiteCart through 2.2.1 allows CSV injection via a customer's profile...

Design/Logic Flaw

LiteCart through 2.2.1 allows CSV injection via a customer's profile...

CVE-2020-9017

LiteCart 2.2.1 and earlier versions are affected by a CSV injection vulnerability in the customer profile handling. The issue, described across multiple sources (CVE-2020-9017 and associated records), enables CSV injection when processing profile data. Public references confirm LiteCart up to ver...