128 matches found
CVE-2019-12134
CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...
Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060
This module enables you to seamlessly migrate and deploy content across environments, eliminating manual steps. It simplifies the process by exporting content to a YML file or a ZIP archive, which can be imported into another environment effortlessly. While the export feature rightfully bypasses...
CVE-2025-27149 Zulip exports can leak private data
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...
CVE-2025-1635
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic...
CVE-2025-1635
The Devolutions Remote Desktop Manager on Windows (versions 2024.3.29 and earlier ) is affected by a security vulnerability (CVE-2025-1635 ) resulting from faulty business logic in the hub data source export feature. This flaw allows an authenticated user to inadvertently include their authentica...
CVE-2024-55532 Apache Ranger: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue...
CVE-2022-48581
A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...
BIT-SUPERSET-2023-25504 Apache Superset: Possible SSRF on import datasets
A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in...
CVE-2024-11094: Exposure of Data Element to Wrong Session
The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive...
PT-2024-16755 · WordPress · 404 Solution
Name of the Vulnerable Software and Affected Versions: The 404 Solution plugin for WordPress versions up to, and including, 2.35.17 Description: The issue allows unauthenticated attackers to extract sensitive data, such as redirects including GET parameters, via the export feature. This could...
PT-2023-7017
Name of the Vulnerable Software and Affected Versions Combodo iTop version 3.1.0-2-11973 Description The issue is related to a CSV injection in the export as CSV feature, allowing a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components...
Typora Cross-Site Scripting Vulnerability
Typora is an editor. A security vulnerability exists in Typora version v.0.9.65, which stems from the presence of a cross-site scripting XSS vulnerability that could allow a remote attacker to obtain sensitive information via the PDF file export feature...
PT-2023-28509 · WordPress · User Activity Log
Name of the Vulnerable Software and Affected Versions: User Activity Log WordPress plugin versions prior to 1.6.6 Description: The issue is related to a lack of proper authorization in the User Activity Log WordPress plugin, allowing any authenticated users to export activity logs and retrieve...
CVE-2023-3435
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks...
SUSE CVE-2016-6609
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...
GHSA-QWX8-MXXX-MG96 wallabag contains Improper Authorization via export feature
Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...
PT-2023-16399 · Wallabag · Wallabag
Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.5.3 Description: The issue concerns an improper authorization vulnerability in the wallabag GitHub repository. It affects the export feature, which allows users to export entries in various formats, such as PDF,...
PT-2022-22957 · WordPress · Wpforms Pro
Name of the Vulnerable Software and Affected Versions: WPForms Pro version 1.7.6 and earlier Description: The issue arises from the lack of validation of form data when generating exported CSV files, potentially leading to CSV injection. Recommendations: For WPForms Pro versions prior to 1.7.7,...
PT-2022-21932 · Unknown · Wp All Export Pro
Name of the Vulnerable Software and Affected Versions: WP All Export Pro versions prior to 1.7.9 Description: The issue allows users with permission to run exports to execute arbitrary SQL statements due to the direct use of the cc sql POST parameter as a database query. This affects users who ha...
