142 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-116219
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the...
CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
UBUNTU-CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
EUVD-2026-109811
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
CVE-2026-116219
Dolibarr ERP CRM versions before 24.0.0 are vulnerable to an OS command injection in htdocs/admin/tools/export.php. This vulnerability allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a mysqldump value with command chaining characters (e.g., &) placed...
CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...
Dolibarr command injection vulnerability
Versions of Dolibarr prior to 24.0.0 contain a command injection vulnerability. This vulnerability stems from an OS command injection issue in htdocs/admin/tools/export.php. Authenticated administrators can bypass the restrictoscommands allow list by crafting mysqldump values and using & characte...
PT-2026-123328
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict os commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basenam...
CVE-2026-6214: Missing Authorization
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...
WordPress Advanced Custom Fields RFI
Advanced Custom Fields plugin ", "rastating", "KittySploit Team", "references": "http://secunia.com/advisories/51037/", "https://wpscan.com/vulnerability/6103/", "cve": "", "platform": Platform.PHP, "arch": Arch.PHP, "payload": "default": "payloads/singles/cmd/php/reversetcp", "arch": Arch.PHP,...
CVE-2019-11428
I, Librarian 4.10 has XSS via the export.php exportfiles parameter...
CVE-2019-7334
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export export.php because proper filtration is omitted...
CVE-2025-64167: Improper Neutralization of Input During Web Page Generation
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...
CVE-2025-12042: Missing Authorization
The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an expo...
EUVD-2020-2843
Malware in sbrugna...