CVE-2025-9776

CVE-2025-9776: Authenticated SQL Injection in CatFolders WordPress Plugin Keywords: CVE-2025-9776, CatFolders WordPress vulnerability, SQL injection WordPress, authenticated SQL injection, WordPress security, CSV import vulnerability, WordPress plugin exploit, CWE-89, WordPress database attack,...

CVE-2026-110595

BottleCRM versions 0.45 through 1.14.5 are vulnerable to a memory exhaustion issue located in the _read_upload() function. The root cause is an uncontrolled memory allocation where the application reads entire CSV uploads into memory before enforcing a 5 MB size limit. Authenticated users with ma...

CVE-2026-110595 BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in readupload that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-3629

CVE-2026-3629 - WordPress Privilege Escalation Checker A command-line tool to detect CVE-2026-3629 , a critical privilege escalation vulnerability in the "Import and export users and customers" WordPress plugin. 📢 Join Our Community Stay updated with the latest security tools, vulnerabilities, an...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

BurpImportSitemap

Import To Sitemap Extension Import To Sitemap is a Burp Suite Extension to import wstalker CSV file or ZAP export file into Burp Sitemap. It also includes a contextual menu to send request/response items from any tab to the sitemap. License Released as open source by NCC Group Plc -...

CVE-2025-64027

Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

EUVD-2026-94613

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-104471

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104471

Versions of YesWiki before 4.6.7 are vulnerable to an unrestricted file upload vulnerability. Authenticated administrators can exploit this by using the Bazar CSV import preview to write remote files into the web-accessible files/ directory. The root cause is a lack of extension checks when a CSV...

CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

EUVD-2026-91482

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

PT-2026-104281

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...