lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example $...

Brother MFC-L9570CDW - Information Disclosure

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

DRUPAL-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

PT-2026-120908

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

PT-2026-115856

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2026-1403

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-1403

GitLab CE/EE versions from 11.7 before 18.8.9 , 18.9 before 18.9.5 , and 18.10 before 18.10.3 are affected by a Denial of Service vulnerability. The root cause is improper validation of CSV file structure during the import process, which allows an authenticated user to cause a denial of service t...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

FreeBSD: VID-099d4998-33cc-11f1-a7d1-2cf05da270f3 (CVE-2026-1403): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the POST /hardware/history process. An attacker can reassign assets and modify audit logs by submitting a crafted CSV file, potentially compromising...

UBUNTU-CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CHIRP chirp-next-20260814 Arbitrary Code Execution

CHIRP's Kenwood ITM file format driver passes raw CSV field values from an opened file directly to Python's built-in eval with no validation. An attacker who delivers a crafted file to a CHIRP user achieves arbitrary code execution as the victim user. CHIRP — Arbitrary Code Execution via eval in...

EUVD-2026-57800

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

PT-2026-68397

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.11.32 Description Insufficient sanitization of values imported from CSV files allows users with the Editor role or higher, including custom shop-management roles, to execute SQL injection attacks. SQL...

CVE-2026-16065: Improper Neutralization of Special Elements used in an SQL Command

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-65875: Improper Neutralization of Formula Elements in a CSV File

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

Refuel Autolab Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python...

CVE-2026-50179: Improper Neutralization of Formula Elements in a CSV File

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix...