23 matches found
CVE-2026-93349-frictionless-command-injection
CVE-2026-93349: Frictionless = 5.20.0rc1 explore OS Command Injection Severity: High, CVSS 3.1 8.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: all Frictionless versions = 5.20.0rc1 Component: frictionless.console.commands.explore CWE: CWE-78 OS Command Injection, CWE-20 Imprope...
CVE-2026-93349
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
CVE-2026-93349 Frictionless OS Command Injection via explore Console Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
CVE-2026-93349 Frictionless OS Command Injection via explore Console Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
CVE-2026-93349
Frictionless versions through 5.20.0rc1 are vulnerable to an OS command injection in the explore console command. The root cause is the unsanitized passing of resource path values from a datapackage.json descriptor to os.system via a shell. An attacker can supply a crafted descriptor containing s...
CVE-2026-93349 Frictionless OS Command Injection via explore Console Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
EUVD-2026-85420
Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...
Exploit for CVE-2026-93349
CVE-2026-93349: Frictionless - Package.fromdescriptor...
PT-2026-97392
Name of the Vulnerable Software and Affected Versions Frictionless versions prior to 5.20.0rc1 Description An OS command injection flaw exists in the explore console command. An attacker can execute arbitrary operating system commands by providing a crafted Data Package descriptor. By placing she...
CVE-2026-93349: Improper Neutralization of Special Elements used in an OS Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
CVE-2024-13396
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-13396
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-13396 Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-13396 Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-13396
CVE-2024-13396 : The Frictionless plugin for WordPress is vulnerable to a stored XSS via the plugin’s frictionless_form shortcode. Affected versions: up to and including 0.0.23. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenti...
PT-2025-2152 · WordPress · Frictionless
Name of the Vulnerable Software and Affected Versions: Frictionless plugin for WordPress versions up to, and including, 0.0.23 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the frictionless form shortcode. This allows...
WordPress plugin Frictionless 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-13396: Improper Neutralization of Input During Web Page Generation
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Frictionless plugin <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Frictionless versions = 0.0.23...
