7129 matches found
CVE-2025-12823
The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2025-12823 CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2025-12823
CVE-2025-12823 affects the WordPress CSV to SortTable plugin (versions ≤ 4.2). The root cause is insufficient input sanitization and output escaping on the csv shortcode attributes, enabling Stored Cross-Site Scripting for authenticated attackers with Contributor-level access or higher. The attac...
EUVD-2025-197946
The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2025-13133: Improper Neutralization of Formula Elements in a CSV File
The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into export...
CVE-2025-12823: Improper Neutralization of Input During Web Page Generation
The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
📄 Snipe-IT 8.3.4 Cross Site Scripting
Snipe-IT version 8.3.4 suffers from a cross site scripting vulnerability. Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT...
WordPress plugin CSV to SortTable has a cross-site scripting vulnerability
WordPress CSV to SortTable plugin is WordPress plugin for converting CSV files to interactive sorting tables. The WordPress CSV to SortTable plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data,...
PT-2025-47286
Name of the Vulnerable Software and Affected Versions Simple User Import Export plugin for WordPress versions up to and including 1.1.7 Description The Simple User Import Export plugin for WordPress is susceptible to CSV Injection through the 'Import/export users' function. This allows...
WordPress Simple User Import Export plugin <= 1.1.7 - Authenticated (Admin+) CSV Injection vulnerability
Authenticated Admin+ CSV Injection vulnerability discovered by Ivan Cese in WordPress Plugin Simple User Import Export versions = 1.1.7...
EUVD-2025-179453
Malicious code in csv-envconfig-achernar-stratigraphy npm...
EUVD-2025-178749
Malicious code in gemini-csv-cryonics-castor npm...
Malicious code in csv-helmet-dione-canopus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c13660b1e5cd8242126ed9b1d8d9e9fd3a9430c6c23281cb67541a8d90eb0873 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in csv-mongodb-rehype-less-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07f821738c4cf7c99d8107896b24f9a81bd00506c105a6aca07ef8a729d5d444 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in csv-steganography-sadr-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 576c9c5300d33eedfca84952fa6d232cca75ad84dbeb63ccde6da8ff03408c5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in kuiperbelt-taurus-csv-ceres (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8993b5329a7604ba0c4c94d86538798b1f58cc2d7e21fb16f89b966ebf27387 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186434 Malicious code in csv-steganography-sadr-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 576c9c5300d33eedfca84952fa6d232cca75ad84dbeb63ccde6da8ff03408c5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189248 Malicious code in rimraf-quantum-csv-javascript (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9909070a68830c6d663c79812a272f46e552253bfb360b94ab3ec3234e687778 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...