PT-2026-120904

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

PT-2026-120908

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk...

npm: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

npm: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-113658

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...

CVE-2026-113658 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...

CVE-2026-113658

ApostropheCMS , an open-source Node.js content management system, contains a vulnerability where the unauthenticated Rich Text CSV conversion route fails to clean up staged files. The system writes multipart uploads to the temporary directory before validating the file extension; if validation fa...

EUVD-2026-105188

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...

CVE-2026-113658 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...

CVE-2022-44830

Suggested description Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Information Proof ...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

CVE-2020-10131

CVE-2020-10131 - CVE-2020-10131 - SearchBlox Product before V-9.2.1 is Vulnerable to CSV macro injection. Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

CVE-2026-110759

A flaw was found in Text::CSVXS. When parsing comma-separated values CSV input ending in a field separator followed by an unescaped carriage return CR character, the parser incorrectly records an end-of-file marker as input data, introducing an extraneous byte into the output field. An attacker w...

CVE-2026-110753

A flaw was found in perl-text-csvxs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service DoS. When processing CSV data configured with bound column variables, the parser improperly releases memory references upon encountering empty rows. Subsequent...

CVE-2026-109221 Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

CVE-2026-109221 Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

CVE-2026-109221

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 4.9.3 . The root cause is insufficient file path validation within the copy_file function during CSV imports. Authenticated attackers with Sales ...