12573 matches found
CVE-2026-16313
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
CVE-2026-16313 Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
CVE-2026-16313
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
CVE-2026-16313
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export User Data versions = 2.2.6...
WP Attachment Export < 0.2.4 - Unrestricted File Download Detection
The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...
Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export Detection
The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. !/usr/bin/env python3 -- coding: utf-8 -- """The lack of proper authorisation when exporting...
ResourceSpace - Metadata Export Detection
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value. !/usr/bin/env python3 -- coding: utf-8 -- """In Montala ResourceSpace through 9.""" from kittysploit import from lib.protocols.http.httpclient...
EventON Lite < 2.1.2 - Arbitrary File Download Detection
The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post...
Prime Mover < 1.9.3 - Sensitive Data Exposure Detection
Prime Mover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.2 via directory listing in the 'prime-mover-export-files/1/' folder. This makes it possible for unauthenticated attackers to extract sensitive data including site and...
Jira Netic Group Export <1.0.3 - Missing Authorization Detection
Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a...
Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure Detection
Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...
WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure Detection
WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Modern Events Calendar Lite before 5.""" from kittysplo...
WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection
WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...
PT-2026-68551
Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7 Description The Export User Data plugin for WordPress allows authenticated attackers with subscriber-level access and above to perform PHP Object Injection. This occurs through the deserialization of...
Malicious code in figma-d2c-utils (npm)
Source: amazon-inspector b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f The package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The destination has no relationship to the package's stated purpo...
Xerox Printers Improper Authentication (CVE-2023-46327)
Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encrypti...
PT-2026-66777
Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.17-1.1 Description The Import/Export Data functionality fails to properly neutralize special elements, which allows a remote attacker to execute arbitrary operating system commands on the server. Recommendations...
Telerik UI for ASP.NET AJAX < 2026.2.708 Multiple Vulnerabilities
The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout...