PT-2025-25251 · Joomla · Rsform!Pro

Name of the Vulnerable Software and Affected Versions: RSForm!pro versions 3.0.0 through 3.3.14 Description: A remote code execution vulnerability was discovered in the RSForm!pro component for Joomla. The issue occurs within the submission export feature and requires administrative access to the...

CVE-2023-27481

Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the password field in directususers can extract the argon2 password hashes by brute forcing the export functionality combined with a startswith filter. This allow...

CVE-2019-19458

SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature...

CVE-2019-12134

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...

Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

This module enables you to seamlessly migrate and deploy content across environments, eliminating manual steps. It simplifies the process by exporting content to a YML file or a ZIP archive, which can be imported into another environment effortlessly. While the export feature rightfully bypasses...

CVE-2025-27149 Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

CVE-2025-1635

The Devolutions Remote Desktop Manager on Windows (versions 2024.3.29 and earlier ) is affected by a security vulnerability (CVE-2025-1635 ) resulting from faulty business logic in the hub data source export feature. This flaw allows an authenticated user to inadvertently include their authentica...

CVE-2025-1635

Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic...

CVE-2024-55532 Apache Ranger: Improper Neutralization of Formula Elements in a CSV File

Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue...

CVE-2022-48581

A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...

BIT-SUPERSET-2023-25504 Apache Superset: Possible SSRF on import datasets

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in...

PT-2024-16755 · WordPress · 404 Solution

Name of the Vulnerable Software and Affected Versions: The 404 Solution plugin for WordPress versions up to, and including, 2.35.17 Description: The issue allows unauthenticated attackers to extract sensitive data, such as redirects including GET parameters, via the export feature. This could...

CVE-2024-11094: Exposure of Data Element to Wrong Session

The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive...

PT-2023-7017

Name of the Vulnerable Software and Affected Versions Combodo iTop version 3.1.0-2-11973 Description The issue is related to a CSV injection in the export as CSV feature, allowing a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components...

Typora Cross-Site Scripting Vulnerability

Typora is an editor. A security vulnerability exists in Typora version v.0.9.65, which stems from the presence of a cross-site scripting XSS vulnerability that could allow a remote attacker to obtain sensitive information via the PDF file export feature...

PT-2023-28509 · WordPress · User Activity Log

Name of the Vulnerable Software and Affected Versions: User Activity Log WordPress plugin versions prior to 1.6.6 Description: The issue is related to a lack of proper authorization in the User Activity Log WordPress plugin, allowing any authenticated users to export activity logs and retrieve...

CVE-2023-3435

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks...

SUSE CVE-2016-6609

An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

GHSA-QWX8-MXXX-MG96 wallabag contains Improper Authorization via export feature

Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...

PT-2023-16399 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.5.3 Description: The issue concerns an improper authorization vulnerability in the wallabag GitHub repository. It affects the export feature, which allows users to export entries in various formats, such as PDF,...