CVE-2024-42901

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

LimeSurvey 安全漏洞

LimeSurvey PHPSurveyor is an open source online questionnaire program from the LimeSurvey team that supports survey program development, survey posting, and data collection. A security vulnerability exists in LimeSurvey version v6.5.12, which stems from the inclusion of a CSV injection...

CVE-2024-42901

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

CVE-2024-42901

Summary: CVE-2024-42901 affects LimeSurvey v6.5.12, where a crafted CSV file upload can trigger a CSV injection that may lead to arbitrary code execution. Details from sources: The vulnerability is described as a CSV injection vulnerability in LimeSurvey v6.5.12 that allows attackers to execute a...

CVE-2024-42901

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

PT-2024-30195 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: Lime Survey version 6.5.12 Description: A CSV injection vulnerability in Lime Survey allows attackers to execute arbitrary code via uploading a crafted CSV file. This issue enables attackers to upload specially crafted CSV files, which can le...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

PT-2024-29312 · Automation Anywhere · Automation Anywhere Automation 360

Name of the Vulnerable Software and Affected Versions: Automation Anywhere Automation 360 version 21094 Description: A CSV injection issue allows attackers to execute arbitrary code via a crafted payload. The payload is injected in the HTTP response from the client-side. Note that Automation...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

CVE-2024-41226

CVE-2024-41226 describes a CSV injection vulnerability in Automation Anywhere Automation 360 (v21094). The underlying issue allows an attacker to trigger arbitrary code execution by injecting a crafted payload into the HTTP response from the client-side, with the end-user owning the response and ...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

CSV Injection

silverstripe/framework is vulnerable to CSV injection. The vulnerability is due to the potential inclusion of executable macros and scripts in the exported CSV files, which allows an attacker to execute arbitrary code or commands on the user's system...

CVE-2023-5527

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2023-5527 Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2023-5527 Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2023-5527

CVE-2023-5527 affects the Business Directory Plugin for WordPress. The vulnerability is a CSV Injection in the class-csv-exporter.php export path, allowing authenticated attackers with author-level permissions and above to inject untrusted input into CSV exports. This can lead to code execution w...

WordPress plugin Business Directory security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

Business Directory Plugin < 6.4.4 - Authenticated (Author+) CSV Injection

Description The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported...

WordPress Business Directory Plugin Plugin <= 6.4.3 is vulnerable to CSV Injection

Software Business Directory Plugin Type Plugin Vulnerable versions = 6.4.3 Fixed in 6.4.4 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5527 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID fa4533c87625 Credits Dmitrii Ignatyev Required privilege Auth...