Potential CSV export data leak

Impact In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user. The bug affects the functionality to export data as CSV files, and was caused by a variable holding the...

WordPress Export Media URLs Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Export Media URLs Type Plugin Vulnerable versions = 1.0 Fixed in 2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51510 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 91519f21c877 Credits Skalucy Required...

CSV Injection

Active Admin is vulnerable to CSV Injection. This vulnerability is due to missing sanitization while exporting a CSV file. An attacker can inject malicious data to a CSV file such as =, +, -', @, \t, \r which results in arbitrary macro execution if the csv file is opened in software such as excel...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 (6.0.1-76)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover improvements in the compute service, object storage, alerts and monitoring. Additionally, this release delivers stability and security improvements, and addresses issues found in previous releases...

Improper Neutralization of Formula Elements in a CSV File

Overview Affected versions of this package are vulnerable to Improper Neutralization of Formula Elements in a CSV File in csvbuilder.rb. An attacker can inject malicious formulas into CSV exports by submitting crafted input to the CSV export feature. Remediation Upgrade activeadmin to version 3.2...

CVE-2023-2487

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1...

CVE-2023-2487

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1...

DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export

Description The plugin does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts...

DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export

Description The plugin does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts. PoC...

Post SMTP < 2.8.7 - Admin+ SQL Injection

Description The plugin does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin. In ps-delete-email-logs action: Visit the Post SMTP Email Log page and run the following code in the...

CVE-2023-34385

Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0...

CVE-2023-34385

Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0...

CVE-2023-34385

CVE-2023-34385 corresponds to a WordPress plugin issue in Export Import Menus. The vulnerability is described as an unrestricted/arbitrary file upload due to missing file type validation in the uploadMenusJson() function, affecting versions up to 1.8.0. The likely risk is high given arbitrary fil...

WordPress Plugin Export Import Menus Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-24855 · Unknown · Export Import Menus

Name of the Vulnerable Software and Affected Versions: Akshay Menariya Export Import Menus versions 1.8.0 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Export Import Menus. There is no information provided about the estimate...

CVE-2023-46154

Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18...

CVE-2023-46154

The CVE-2023-46154 entry describes a PHP Object Injection (deserialization) vulnerability in the E2Pdf – Export To Pdf Tool for WordPress plugin. Exploitation requires Administrator privileges and affects versions up to 1.20.18; the issue can lead to arbitrary object injection due to untrusted da...

CVE-2023-46154 WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18...

CVE-2023-5886

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading t...

CVE-2023-4724

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the wpquery parameter which allows an attacker to run arbitrary command on the remote server...