WordPress plugin Metform Elementor Contact Form Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

ERPGo SaaS 3.9 - CSV Injection

Exploit Title: ERPGo SaaS 3.9 - CSV Injection Date: 18/01/2023 Exploit Author: Sajibe Kanti Vendor Name: RajodiyaInfotech Vendor Homepage: https://rajodiya.com/ Software Link: https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426 Version: 3.9...

ERPGo SaaS 3.9 - CSV Injection Vulnerability

Exploit Title: ERPGo SaaS 3.9 - CSV Injection Exploit Author: Sajibe Kanti Vendor Name: RajodiyaInfotech Vendor Homepage: https://rajodiya.com/ Software Link: https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426 Version: 3.9 Tested on: Windows &...

Embeding untrusted input inside CSV files leads to Formula Injection/CSV Injection

Description The pimcore application is vulnerable to Formula Injection/CSV Injection via the Firstname, Lastname, Street, Zip & City input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a crafted excel file. Proof of Concepta 1.Go to...

WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection

Software Export Users Data Distinct Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-46804 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID b4f52c7c2803 Credits Mika Required privilege Subscriber Publish...

WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection

Software amr users Type Plugin Vulnerable versions = 4.59.4 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45348 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID af617aa8d2cb Credits Mika Required privilege Subscriber Published 22 March,...

CSV Injection in CSV files generated by the backend

1 login in https://demo.limesurvey.org/index.php 2 the demo admin create a user with name "=1+cmd|'/C calc'!A0". 4 other users login and download all the users' data as csv. 5 other users open the csv file with execl in windows, notice that choose ";" as separator as. 6 we can see that the...

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-22719 Patch priority Low CVSS severity Low 4.7 Developer Liquid Web / StellarWP PSID 7ead0bb10ca7 Credits Rafshanzani Suhada Required privilege...

FortiAnalyzer - CSV injection in macro name

An improper neutralization of formula elements vulnerability CWE 1236 in FortiAnalyzer may allow a local authenticated privileged attacker to execute arbitrary code on the end-user's host via inserting spreadsheet formulas in the macro names. This is achieved once the user downloads and opens the...

CSV Injection in CSV files generated by the backend

1 First the admin create the event and publish it. 2 unauthenticated users go to the reservation page 3 unauthenticated users fill the fisrst name and last name as "=1+cmd|'/C calc'!A0" 4 admin download all the attendees' data as csv. 5 admin open the csv file and the calculator is opened. see th...

WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

Software Simple CSV/XLS Exporter Type Plugin Vulnerable versions = 1.5.8 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-42882 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 88fece4e6031 Credits Mika Required privilege Editor Published 2...

WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection

Software KB Support Type Plugin Vulnerable versions = 1.5.84 Fixed in 1.5.85 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-25983 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID b58305c78eef Credits Rafshanzani Suhada Required privilege Subscriber...

WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

Software UsersWP Type Plugin Vulnerable versions = 1.2.3.9 Fixed in 1.2.3.10 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-47442 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 9e86dfeb7cfc Credits Justiice Required privilege Subscriber Published 20...

SUSE CVE-2020-22278

phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents...

WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection

Software Product Reviews Import Export for WooCommerce Type Plugin Vulnerable versions = 1.4.8 Fixed in 1.4.9 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-46802 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 8bd54902f1b0 Credits Mika Required...

WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection

Software WordPress Comments Import & Export Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45370 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID aa57ae50e983 Credits Mika Required privilege...

WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.5.2 Fixed in 5.5.3 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45810 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID bc18fb9ece3e Credits Mika Required privilege...

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

Software 1003 Mortgage Application Type Plugin Vulnerable versions = 1.75 Fixed in 1.80 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45357 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID aadde6bd0ebf Credits Rodrigo Escobar ipax Required privilege...

WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection

Software Simple History Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.4.0 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45350 Patch priority Low CVSS severity Low 3 Developer Claim ownership PSID d53822044a90 Credits ed32.dll Required privilege Subscriber Published 2...

WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

Software Commenter Emails Type Plugin Vulnerable versions = 2.6.1 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45360 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 7afa84e72c95 Credits Mika Required privilege Unauthenticated Published ...