CVE-2026-1403

GitLab CE/EE versions from 11.7 before 18.8.9 , 18.9 before 18.9.5 , and 18.10 before 18.10.3 are affected by a Denial of Service vulnerability. The root cause is improper validation of CSV file structure during the import process, which allows an authenticated user to cause a denial of service t...

FreeBSD: VID-099d4998-33cc-11f1-a7d1-2cf05da270f3 (CVE-2026-1403): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

PT-2026-68397

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.11.32 Description Insufficient sanitization of values imported from CSV files allows users with the Editor role or higher, including custom shop-management roles, to execute SQL injection attacks. SQL...

Command Injection

idno/known is vulnerable to Command Injection. The vulnerability is due to improper handling of file imports combined with template path traversal, which allows an attacker to write malicious files and execute arbitrary code on the server...

CVE-2020-36997

BacklinkSpeed 2.4 contains a buffer overflow vulnerability that allows attackers to corrupt the Structured Exception Handler SEH chain through malicious file import. Attackers can craft a specially designed payload file to overwrite SEH addresses, potentially executing arbitrary code and gaining...

Dummy BacklinkSpeed security vulnerability

Dummy BacklinkSpeed is an SEO automation tool developed by theDummy company. Version 2.4 of Dummy BacklinkSpeed contains a security vulnerability. This vulnerability arises from the possibility of buffer overflows caused by the import of malicious files, which can disrupt the structured exception...

PT-2025-42498

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.7.6 Nextcloud Tables versions prior to 0.8.8 Nextcloud Tables versions prior to 0.9.5 Description Nextcloud Tables allows users to create tables with custom columns. Prior to versions 0.7.6, 0.8.8, and 0.9....

EUVD-2025-23394

Malicious code in bioql PyPI...

Zimbra Collaboration Suite XSS

The vulnerability of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure when importing files into the portfolio. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2025-53012

MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsin...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the com.powsybl.commons.xml.XmlReader class. An attacker can access sensitive files or internal resources by submitting specially crafted XML input. Note: This is only exploitable if untrusted users...

CVE-2022-3374

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import intentionally or not a malicious Customizer Styling file and a suitable gadget chain is present on the blog...

Stack Based Buffer Overflow

MaterialX is vulnerable to stack-based buffer overflow. The vulnerability is due to the lack of a limit on nested file import recursion, which allows an attacker to craft deeply chained MaterialX file imports leading to a crash of the process...

Server Side Request Forgery (SSRF)

Directus is vulnerable to Server-Side Request Forgery SSRF. This vulnerability is caused by insecure redirects during file imports from external sources due to proper validation of the resulting URL, which can allows an attacker to send crafted requests to internal IP addresses, resulting in SSRF...

WithSecure Multiple Product Resource Management Error Vulnerability

WithSecure products is a series of security software from the Finnish company WithSecure. WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and earlier. versions, WithSecure Client Security for Mac 15,...

PT-2022-21773 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP WordPress plugin versions prior to 1.5.0 Description: The issue arises from the unserialization of the content of an imported file, potentially leading to a PHP object injection issue. This can occur when an admin imports a...

SAP BusinessObjects Business Intelligence Lifecycle Management Unauthorized Access

The vulnerability of the Lifecycle Management console component of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information, change...

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

Description Higher severity CSRF in PKP-LIB plugins ImportExport is vulnerable to CSRF in terms of file uploads and file imports, an attacker can import arbitrary users into the platform, 1: POST /index.php/e/management/importexport/plugin/UserImportExportPlugin/uploadImportXML 2: GET...

Cross-site Request Forgery (CSRF)

WooCommerce is vulnerable to cross-site request forgery CSRF. The attack exists because it does not check the .csv file imports in includes/admin/importers/class-wc-product-csv-importer-controller.php, allowing an attacker to provide malicious inputs and valid nonce to lead to the attack...