CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-15481: Missing Authentication for Critical Function

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

PT-2026-90712

Text::CSV XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption...

PT-2026-84710

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-2122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2122 advisory. Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-2124)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2124 advisory. Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

[SECURITY] [DLA 4764-2] libdbd-csv-perl regression update

Debian LTS Advisory DLA-4764-2 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 31, 2026 https://wiki.debian.org/LTS Package : libdbd-csv-perl Version : 0.5800-1+deb11u1 0.6000-1+deb12u1 Debian Bug : 1139509 The security fix for CVE-2026-15392 symlink escape ...

Low: python3.12

Issue Overview: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff. CVE-2026-18503 Element.findall and fully-consumed Element.iterfind exhibit On^2 time...

Low: python3.11

Issue Overview: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff. CVE-2026-18503 Element.findall and fully-consumed Element.iterfind exhibit On^2 time...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-2125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2125 advisory. Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

CVE-2026-80488

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

EUVD-2026-68061

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

WordPress WP Ultimate CSV Importer plugin < 9.0 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Jaan Buerms in WordPress Plugin WP Ultimate CSV Importer versions 9.0...

CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-80488

The WP Ultimate CSV Importer WordPress plugin (versions before 9.0 ) is vulnerable to SQL injection because it fails to properly sanitize and escape imported field values before including them in a SQL statement. This flaw allows users with high privileges , such as administrators, to execute arb...

CVE-2026-80488: Improper Neutralization of Special Elements used in an SQL Command

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

PT-2026-83413

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.0 Description Insufficient sanitization and escaping of imported field values before their use in a SQL statement allows high privilege users, such as administrators, to perform SQL injection attack...