CVE-2025-4185 Wangshen SecGate 3600 g=obj_area_export_save path traversal

A vulnerability, which was classified as critical, has been found in Wangshen SecGate 3600 2024. This issue affects some unknown processing of the file ?g=objareaexportsave. The manipulation of the argument filename leads to path traversal. The attack may be initiated remotely. The exploit has be...

BIT-GHOST-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

H2O Vulnerable to Arbitrary File Overwrite via File Export

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a...

Linux Distros Unpatched Vulnerability : CVE-2022-49675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tick/nohz: unexport init-annotated ticknohzfullsetup EXPORTSYMBOL and init is a bad...

CVE-2022-49726

In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport init-annotated hvinitclocksource EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The...

CVE-2022-49675

Summary (CVE-2022-49675): In the Linux kernel, the function tick_nohz_full_setup() is exported while annotated with init , which risks a use-after-free of the init text and kernel panic. The issue was detected after a section-mismatch warning from modpost and fixed by the commit 28438794aba4 (“mo...

Mattermost fails to restrict channel export of archived channels

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

CVE-2022-25713

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key...

PT-2025-32000 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 1.1 through 16.4.6 XWiki Platform versions 16.5.0-rc-1 through 16.10.4 XWiki Platform versions 17.0.0-rc-1 through 17.1.0 Description: XWiki Platform Legacy Old Core and XWiki Platform Old Core are affected by an issue...

CVE-2024-13295

Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X- before 7.X-3.3...

CVE-2024-13295 Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X- before 7.X-3.3...

CVE-2024-9102

PHP LDAP Admin (phpLDAPadmin) versions 1.2.0 through 1.2.6.7 are vulnerable to CSV Formula Injection when exporting directory entries to CSV, because the export path does not neutralize elements that can be interpreted as commands by spreadsheet apps. This can allow an attacker-controlled data el...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

PT-2024-19710 · Open Xchange Gmbh +1 · Ox App Suite

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises from E-Mails being exported as PDF and stored in a cache that does not consider specific session information for the related user account. This allows users of the same...

PT-2024-12993 · Motorola · Motorola Carrier Services

Name of the Vulnerable Software and Affected Versions: Motorola Carrier Services affected versions not specified Description: An improper export issue in the Motorola Carrier Services application could allow a malicious, local application to read files without authorization. Recommendations: At t...

PT-2023-14657 · WordPress · Webtoffee Wordpress Comments Import & Export

Name of the Vulnerable Software and Affected Versions: WebToffee WordPress Comments Import & Export versions 2.3.1 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file. This can potentially lead to unintended consequences when importing or...

EUVD-2023-0205

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

PT-2022-22577 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: Awesome Support WordPress plugin versions prior to 6.1.2 Description: The issue allows a low-privileged user, such as a subscriber, to download arbitrary exported tickets via an IDOR vector. This occurs because the plugin does not ensure that...