OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

Summary The export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then ...

WordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by UKO Patchstack Alliance in WordPress Plugin Import and export users and customers versions = 1.27.5...

OpenRefine security vulnerabilities

OpenRefine is a Java-based open source tool from OpenRefine Open Source. The product is mainly used for loading data, analyzing data, and cleaning data, among other things. A security vulnerability exists in OpenRefine prior to version 3.8.3, which stems from the fact that export-rows can be...

CVE-2024-47880: Improper Neutralization of Input During Web Page Generation

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page th...

WordPress Import and export users and customers Plugin <= 1.27.5 is vulnerable to Cross Site Scripting (XSS)

Software Import and export users and customers Type Plugin Vulnerable versions = 1.27.5 Fixed in 1.27.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50413 Patch priority Low CVSS severity Low 5.9 Developer Codection PSID 2e6cb770bca3 Credits UKO Required privile...

Pandoc format conversion library File Write

The vulnerability of the Pandoc format conversion library written in Haskell is related to insufficient validation of input data. Exploiting this vulnerability allows attackers to create or overwrite arbitrary files in the system by using the --extract-media parameter or by exporting files in PDF...

CVE-2024-49244

CVE-2024-49244 describes a SQL Injection in the cmssoft CSV Product Import Export for WooCommerce plugin, affecting versions 1.0.0 and earlier. The vulnerability stems from improper sanitization of input used in SQL commands. Public records (NVD, Red Hat, Patchstack) list the vulnerability with C...

CVE-2024-49244 WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a through = 1.0.0...

CVE-2024-9347

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-9347: Improper Neutralization of Input During Web Page Generation

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-49244: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a through = 1.0.0...

WordPress plugin CSV Product Import/Export for WooCommerce: SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

WordPress plugin Logo Slider has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the component /index.php?page=backup/export. An attacker can access files and directories stored outside of the web server's root directory by manipulating file paths in the input. PoC php Details A Directory...

Path traversal in redaxo

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal...

MAL-2024-9763 Malicious code in plugin-transform-export-namespace-from (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugin-transform-export-namespace-from (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9610 Malicious code in export-gltf (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in export-gltf (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-46212: Improper Limitation of a Pathname to a Restricted Directory

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal...