5439 matches found
CVE-2018-15474
Summary: CVE-2018-15474 affects DokuWiki up to version 2018-04-22a (Greebo) in /lib/plugins/usermanager/admin.php. A value mishandled during CSV export enables CSV/Formula Injection, allowing remote data exfiltration and potential arbitrary code execution. The vulnerability is described across mu...
Design/Logic Flaw
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The CVE-2018-16651 entry applies to phpMyFAQ (admin backend) before version 2.9.11, where CSV injection in reports is possible due to insufficient sanitization of report content. The vulnerability is reflected with a HIGH CVSS score (3.0: 7.2; 2.0: 9.0) and can impact multiple CIA aspects as defi...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
DokuWiki 2018-04-22a Greebo Arbitrary Code Execution Vulnerability
DokuWiki version 2018-04-22a Greebo suffers from a CSV formula injection vulnerability that allows for arbitrary code execution. ======================================================================= title: CSV Formula Injection product: DokuWiki vulnerable version: 2018-04-22a "Greebo" and olde...
DokuWiki 2018-04-22a Greebo Arbitrary Code Execution
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: CSV Formula Injection product: DokuWiki vulnerable version: 2018-04-22a "Greebo" and older versions fixed version: None CVE number: CVE-2018-15474 impact: Medium homepage...
CVE-2018-16308
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection...
CVE-2018-16308
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection...
Design/Logic Flaw
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection...
CVE-2018-16308
CVE-2018-16308 — CSV Injection in WordPress Ninja Forms is a vulnerability in the Ninja Forms plugin for WordPress, affecting versions before 3.3.14.1. The issue is a CSV injection flaw in the plugin’s handling of form data exported to CSV. The CVSS metrics indicate a high impact when exploited l...
CVE-2018-16308
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection...
WordPress Export Users to CSV plugin <= 1.1.1 - CSV Injection vulnerability
CSV Injection vulnerability found by Javier Olmedo in WordPress Export Users to CSV plugin versions = 1.1.1. Solution 2018.09.01 - we were unable to find a patched version of this plugin...
Input validation
OPSWAT MetaDefender before v4.11.2 allows CSV injection...
CVE-2018-16275
OPSWAT MetaDefender before v4.11.2 allows CSV injection...
CVE-2018-16275
CVE-2018-16275 affects OPSWAT MetaDefender prior to 4.11.2 and enables CSV injection. The connected sources consistently state the product and version boundary, identifying the vulnerability as CSV injection in that release line. The CVE details do not provide explicit exploit vectors beyond this...
CVE-2018-16275
OPSWAT MetaDefender before v4.11.2 allows CSV injection...
Automattic: Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerce
This vulnerability is based on the following exploitation technique: https://blog.ripstech.com/2018/new-php-exploitation-technique/ It is easier to explain this vulnerability by having watched the PoC first: https://www.youtube.com/watch?v=mr3bAOIUwd4 Here is what's happening: 1. Since a valid ph...
