CVE-2026-54166

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166: Server-Side Request Forgery (SSRF)

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2024-56157

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

CVE-2024-56157 iTop vulnerable to Self XSS in CSV Import

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

PT-2025-21169 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.1.3 and 3.2.1 Description: The issue allows a cross-site scripting attack to be performed when importing malicious CSV content. This can be done by filling malicious code in a CSV content. The estimated number of...

CVE-2024-31448

Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting XSS attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to...

CVE-2024-31448

CVE-2024-31448 is a Cross-site Scripting (XSS) vulnerability in Combodo iTop triggered by malicious CSV content during import. Affected software is Combodo iTop (web-based IT Service Management). The issue is fixed in versions 3.1.2 and 3.2.0; users should upgrade to one of these versions or late...

PT-2024-24082

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0 Description The issue is related to a Cross-site Scripting XSS attack that can be performed when importing malicious CSV content. This can be done by filling malicious...

CVE-2022-47163

Cross-Site Request Forgery CSRF vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin = 2.6 versions...

The vulnerability in the implementation of the Export Utility function of the Ultimate SMS Notifications plugin for WooCommerce, a content management system for WordPress websites, allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Export Utility function implementation in the Ultimate SMS Notifications plugin for WooCommerce, a content management system for WordPress websites, is related to the absence of a mechanism to neutralize elements in the CSV file. Exploiting this vulnerability could allow ...

IBM Planning Analytics Injection Vulnerability

IBM Planning Analytics is a business planning and analysis solution from IBM Corporation. The solution supports automated execution of business planning, budgeting, and analysis processes.IBM Planning Analytics has a security vulnerability that stems from incorrect validation of csv file content...