CVE-2025-64027

The IT asset management system Snipe-IT v8.3.4 (build 20218) is vulnerable to a reflected cross-site scripting (XSS) flaw in the CSV Import workflow. The root cause is the lack of sanitization for the progress_message value, which the application renders as raw HTML in the admin interface. An att...

TencentOS Server 4: python3.12 (TSSA-2025:0248)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0248 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system from Grokability Open Source. A security vulnerability exists in Snipe-IT version v8.3.4, which stems from the presence of reflective cross-site scripting in the CSV import workflow, which could lead to the execution of arbitrary...

CVE-2025-13145

CVE-2025-13145 describes a PHP Object Injection vulnerability in the WordPress plugin WP Import – Ultimate CSV XML Importer for WordPress (versions up to and including 7.33.1). The issue arises from deserializing untrusted data during CSV imports in SingleImportExport.php (import_single_post_as_c...

EUVD-2025-197967

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into export...

CVE-2025-13133

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into export...

CVE-2025-13133 Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into export...

WordPress plugin Simple User Import Export 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Import any XML, CSV or Excel File to WordPress 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin Impor...

CVE-2025-64406 Apache OpenOffice: Possible memory corruption during CSV import

An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the...

EUVD-2025-114038

Malicious code in envconfig-csv-build-chai npm...

EUVD-2025-121547

Malicious code in superagent-cross-env-csv-nodemon npm...

EUVD-2025-114654

Malicious code in dactyl-superagent-csv-hermes npm...

EUVD-2025-113868

Malicious code in eslint-plugin-spectron-csv-aether npm...

EUVD-2025-111789

Malicious code in less-loader-lint-staged-csv-local npm...

WordPress plugin Import WP – Export and Import CSV and XML files to WordPress 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension that can ...

Exploit for HTTP Request Smuggling in Sap Content_Server

CVE-2022-22536 Batch Scanner This is a fast, socket-level bat...

CVE-2025-12249

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now...

CVE-2025-12249 Axosoft Scrum and Bug Tracking Edit Ticket csv injection

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now...

[SECURITY] [DLA 4349-1] request-tracker4 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4349-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 26, 2025 https://wiki.debian.org/LTS -...