CVE-2019-15821

The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data...

Vtiger CRM Open Source Edition 安全漏洞

Vtiger CRM Open Source Edition is a customer relationship management software from Vtiger, Inc. A security vulnerability exists in Vtiger CRM Open Source Edition version v8.3.0, which originates from the ZIP import feature and could lead to the execution of arbitrary PHP code...

CVE-2024-56157

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

CVE-2024-56157

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

CVE-2025-32427

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...

GHSA-CCJ3-5P93-8P42 SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

CVE-2024-13810 Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zassimportzass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with...

GHSA-5FWX-P6XH-VJRH Mattermost allows reading arbitrary files related to importing boards

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

Mattermost allows reading arbitrary files related to importing boards

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

Exploit for CVE-2024-42845

CVE-2024-42845: Remote Code Execution RCE in Invesalius 3.1...

CVE-2024-55089

Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function. The issue’s affected component is Rhymix (CMS/framework), with the root cause being insecure handling of server-side requests during the import process. Reported impact includes potential una...

WordPress WP All Import Pro plugin <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import vulnerability

Authenticated Administrator+ Server-Side Request Forgery via File Import vulnerability discovered by Ivan Kuzymchak in WordPress Plugin WP All Import Pro versions = 4.9.3...

CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication...

WordPress Music Player for Elementor plugin <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import vulnerability

Missing Authorization to Authenticated Subscriber+ Template Import vulnerability discovered by WordFence in WordPress Plugin Music Player for Elementor – Audio Player & Podcast Player versions = 2.4.1...

The vulnerability of the dynamicImport() function in the lilconfig configuration tool allows a hacker to execute arbitrary code.

The vulnerability of the dynamicImport function in the lilconfig configuration tool is related to improper handling of code generation when processing the.d.ts syntax. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Apache Allura Code Issue Vulnerability

Apache Allura is a suite of open source project hosting platforms from the Apache USA Foundation. The platform supports the management of source code repositories, bug reports, wiki pages and blogs. A code issue vulnerability exists in Apache Allura versions 1.0.1 through 1.16.0, which stems from...

The vulnerability of the data import function in the 1C8 CMS system’s Netcat module stems from deficiencies in the authentication process. This allows attackers to bypass the HTTP Basic authentication process and gain unauthorized access to the data import function of 1C.

The vulnerability of the automatic data import function in the 1C8 CMS system’s Netcat component is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to bypass the HTTP Basic authentication process and gain unauthorized access to the data impo...

The vulnerability of the Data Import component of the Oracle Agile Product Lifecycle Management for Process application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Data Import component of the Oracle Agile Product Lifecycle Management for Process application is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2024-21423 · Icegram Express · Email Subscribers

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress versions up to, and including, 5.7.14 Description: The issue is related to Stored Cross-Site Scripting via a CSV...

Import WP < 2.13.1 - Admin+ Server-side Request Forgery

Description The plugin does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations. 1. As an admin, create a new importer in /wp-admin/tools.php?page=importwp 2. Visit /wp-admin/admin-ajax.php?action=rest-nonce and...