169 matches found
CVE-2021-24915: Improper Neutralization of Special Elements used in an SQL Command
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
CVE-2021-24451
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection...
CVE-2021-24451
The CVE-2021-24451 entry concerns the WordPress plugin Export Users With Meta (before 0.6.5). The vulnerability arises because the plugin did not escape the list of roles when constructing the SQL in the export function, which is accessible to admins, enabling authenticated SQL injection. Affecte...
CVE-2021-24451 Export Users With Meta < 0.6.5 - Authenticated SQL Injection
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection...
CVE-2021-24451: Improper Neutralization of Special Elements used in an SQL Command
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection...
WordPress 插件 SQL注入漏洞
WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Meta plugin is an application plugin for WordPress. A SQL injection vulnerability exists in the WordPress Export Users...
Export Users With Meta < 0.6.5 - Authenticated SQL Injection
The plugin did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection. POST /wp-admin/users.php?page=uewmsettings HTTP/1.1 Accept:...
WordPress Export Users With Meta plugin <= 0.6.4 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability discovered by Asif Nawaz Minhas in WordPress Export Users With Meta plugin versions = 0.6.4. Solution Update the WordPress Export Users With Meta plugin to the latest available version at least 0.6.5...
CVE-2020-22277
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile...
CVE-2020-22277: Improper Neutralization of Formula Elements in a CSV File
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile...
Design/Logic Flaw
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
CVE-2020-9466
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
CVE-2020-9466
CVE-2020-9466 affects the WordPress plugin Export Users to CSV (≤1.4.2). An attacker who can register as a subscriber can inject CSV payloads into user-details fields; when an authenticated admin exports user data to CSV and opens it, the payload can execute (e.g., redirections to malicious sites...
CVE-2020-9466: Improper Neutralization of Formula Elements in a CSV File
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
WordPress Export Users to CSV plugin <= 1.4.2 - CSV Injection vulnerability
CSV Injection vulnerability found by Jinson Varghese Behanan in WordPress Export Users to CSV plugin versions = 1.4.2. Solution 2020 Feb. 26 - no patched version available...
Export Users to CSV <= 1.4.2 - CSV Injection
An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...
Export Users to CSV <= 1.4.2 - CSV Injection
An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...
PT-2019-6281 · WordPress · Wp Users Exporter
Name of the Vulnerable Software and Affected Versions: WP Users Exporter plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to CSV Injection via the 'Export Users' functionality, allowing authenticated attackers to embed untrusted input into profile...
