338 matches found
CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled
Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...
CVE-2024-13783
The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin da...
CVE-2024-13556
CVE-2024-13556 affects the WordPress plugin “Affiliate Links: WordPress Plugin for Link Cloaking and Link Management.” The vulnerability is a PHP Object Injection via deserialization of untrusted input from a file export, affecting all versions up to 3.0.1. An unauthenticated attacker could injec...
CVE-2024-11629
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF...
CVE-2024-35430
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...
CVE-2024-11629
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF...
CVE-2024-11629
CVE-2024-11629 affects Progress Telerik Document Processing Libraries (prior to 2025 Q1, version 2025.1.205) when targeting .NET Standard 2.0. The issue allows exporting the contents of a file at an arbitrary path to RTF, indicating an potential arbitrary file read/export vulnerability due to the...
CVE-2020-15255
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software for example, when a cell value starts with an equal sign. This is fixed in version 1.19.23.5325...
CVE-2024-13607 JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticat...
CVE-2024-12269 Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export
The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...
PT-2025-1922 · WordPress · Moving Users
Name of the Vulnerable Software and Affected Versions: Moving Users plugin for WordPress versions up to and including 1.05 Description: The Moving Users plugin for WordPress is vulnerable to sensitive information exposure in its export functionality. This issue arises because JSON files are store...
CVE-2024-12274
The CVE-2024-12274 entry concerns BookingPress (Appointment Booking Calendar Plugin and Scheduling Plugin) for WordPress, affecting versions before 1.1.23. Technical details across connected sources confirm an unauthenticated risk: the Export Settings feature writes data to a publicly accessible ...
CVE-2024-13295
CVE-2024-13295 affects Drupal Node export module for Drupal 7.X-* before 7.X-3.3. Root cause is deserialization of untrusted data, leading to object injection and potential arbitrary code execution. Affected software: Drupal Node export module (7.X-*, prior to 7.X-3.3). Impact per sources: possib...
Moodle 安全漏洞
Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from the fact that when creating an export of a site management preset,...
SourceCodester Online Graduate Tracer System 信息泄露漏洞
SourceCodester Online Graduate Tracer System is a web-based application project developed by SourceCodester using PHP and MySQL database. Its main purpose is to provide a platform for a school to track their alumni and generate graphical reports on alumni status. An information disclosure...
CVE-2024-37550
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22...
CVE-2024-34448
Ghost before 5.82.0 allows CSV Injection during a member CSV export...
Ghost Foundation Ghost 安全漏洞
Ghost Foundation Ghost is an open source personal blogging system written in JavaScript by Ghost. A security vulnerability exists in Ghost Foundation Ghost versions prior to 5.82.0, which stems from a vulnerability that allows an attacker to perform a CSV injection attack during a CSV export...
CVE-2024-3479
An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider com.motorola.server.enterprise.MotoDpmsProvider that could allow a local attacker to read local data...