CVE-2026-114529

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114529 CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114529

The Drupal CSV Field module is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input sanitization during web page generation. The issue occurs because the module fails to sufficiently escape CSV cell and header values before passing them to the DataTables library . This affects ve...

EUVD-2026-113546

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114529 CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114529

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CVE-2026-114529: Drupal CSV Field: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field…

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7...

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

Open Zaak Information Leak Vulnerability

Versions of Open Zaak 1.13.0 to 1.27.2 and 1.28.0 to 1.28.2 have a vulnerability related to information leakage. This vulnerability arises from the lack of validation for path handling when importing document rows in the importdocumentrow function, specifically in the bestandspad CSV field. The...

CVE-2026-31049

Hostbill versions v.2025-11-24 and 2025-12-01 are vulnerable to an issue involving the improper neutralization of formula elements in a CSV file. A remote attacker can exploit the CSV registration field to achieve arbitrary code execution and escalate privileges . Exploitation details are not pro...

WordPress Community Events plugin <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field vulnerability

Authenticated Administrator+ SQL Injection via 'cevenuename' CSV Field vulnerability discovered by Bee - FPT University in WordPress Plugin Community Events versions = 1.5.8...

CVE-2026-2429

The CVE-2026-2429 entry concerns the WordPress Community Events plugin. It describes an SQL Injection vulnerability via the ce_venue_name field in the on_save_changes_venues function, affecting all versions up to 1.5.8. The issue stems from insufficient escaping of user-supplied CSV data and inad...

CVE-2026-2429 Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'cevenuename' CSV field in the onsavechangesvenues function in all versions up to, and including, 1.5.8. This is due to insufficient escaping on the user-supplied CSV data and lack of sufficient preparation on the...

PT-2026-23814

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce venue name' CSV field in the on save changes venues function in all versions up to, and including, 1.5.8. This is due to insufficient escaping on the user-supplied CSV data and lack of sufficient preparation on t...

CVE-2025-65923

A Stored Cross-Site Scripting XSS vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the...