PT-2025-47698

The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated...

EUVD-2024-52741

Malicious code in bioql PyPI...

GO-2025-3911 Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server

Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2025-8402

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature...

CVE-2025-8402 Nil pointer dereference in bulk import crashes server

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature...

CVE-2025-1848

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /importdatacheck. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2025-1849

A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /importdatatodb. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2025-1848

CVE-2025-1848 affects zj1983 zz up to 2024-8, with a vulnerability in an unknown function under the file /import_data_check that allows manipulation of the url parameter to trigger server-side request forgery (SSRF). Exploitation can be performed remotely; public disclosures and vendor non-respon...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and earlier versions, which stems from a server-side request forgery in the importdatacheck file...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and earlier versions, which stems from a server-side request forgery in the importdatatodb file...

WordPress plugin Visualizer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2025-1065: Improper Neutralization of Input During Web Page Generation

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied...

WordPress Visualizer plugin <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Import Data From File vulnerability discovered by Webbernaut in WordPress Plugin Visualizer versions = 3.11.8...

CVE-2024-9664

The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP...

CVE-2024-55089: Server-Side Request Forgery (SSRF)

Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery SSRF in the background import data function because XML documents may contain external entities...

Rhymix 安全漏洞

Rhymix is an open source CMS and framework from Rhymix Inc. A security vulnerability exists in Rhymix version 2.1.19, which stems from a server-side request forgery vulnerability in the backend import data function...

CVE-2024-55089

Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery SSRF in the background import data function because XML documents may contain external entities...

CVE-2022-1226: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include...

phpIPAM 安全漏洞

phpIPAM is the phpIPAM open source suite of open source PHP and MySQL based IP address management applications IPAM. A security vulnerability exists in phpIPAM version 1.6, which stems from the presence of a cross-site scripting XSS vulnerability via appadminimport-exportimport-load-data.php...

PT-2024-29371

Name of the Vulnerable Software and Affected Versions phpipam version 1.6 Description The issue is a Cross Site Scripting XSS vulnerability. It occurs through the appadminimport-exportimport-load-data.php file. This allows for potential malicious script execution. Recommendations For phpipam...