CVE-2025-9215

StoreEngine 强大的 WordPress 电子商务插件（支付、会员、联盟营销、销售等）= 1.4.0 - 已认证（订阅者+）任意文件下载 StoreEngine 插件在其 CSV 导入/导出功能中包含一个漏洞，该漏洞允许任何已认证用户 （订阅者、作者、编辑等）从服务器下载任意文件，包括敏感的系统文件、WordPress 配置文件以及插件源代码。该漏洞源于 storeenginecsv/filedownload 端点缺乏适当的路径清理，仅依赖 nonce 验证来保证安全，而 storeenginenonce 通过插件的 JavaScript 暴露给所有前端用户...

pecli

PEcli 用于分析 PE 文件的 Python 3 工具。当前功能： 显示文件信息（导入、导出、资源） 搜索文件中的有趣信息（异常资源、peid...） 转储节或资源 检查大小 在文件中搜索字符串 安装 你可以从 pypi 安装它：pip install pecli 或者直接从源代码安装： root@kitploit: git clone https://github.com/Te-k/pecli.git cd pecli pip install . 使用方法 PEcli 通过插件工作，例如 pecli PLUGIN FILE root@kitploit: usage: pecli -...

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

CVE-2026-76547

CVE-2026-76547 affects the User Profile Builder WordPress plugin before version 4.0.1 . The root cause is unvalidated deserialization when importing a configuration file, enabling PHP Object Injection by high-privilege users (e.g., administrators). Two significant mitigating factors reduce practi...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-17566

CVE-2026-17566 — PoC RCE per l'Import/Export Data di pgAdmin 4 PoC di esecuzione remota di codice per lo strumento Import/Export Data di pgAdmin 4. Sfrutta la divergenza semantica dell'escaping della barra rovesciata tra il controllo parentesi isqueryparensbalanced e psql, iniettando \copy ... TO...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Leitura Arbitrária de Arquivo Autenticada Author+ via Directory Traversal Descrição O plugin WordPress Comments Import & Export para WordPress é vulnerável a leitura arbitrária de arquivos devido à validação insuficiente do caminho do...

CVE-2024-54262

CVE-2024-54262 Exploit CVE-2024-54262: Beliebiger Datei-Upload in Import Export for WooCommerce Übersicht Dieses Skript nutzt eine Schwachstelle im WordPress-Plugin "Import Export for WooCommerce" aus. Die Schwachstelle erlaubt es nicht autorisierten Benutzern, beliebige Dateien hochzuladen, was ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2022-0236

CVE-2022-0236 Das WP Import Export WordPress Plugin ist anfällig für die Offenlegung sensibler Daten ohne Authentifizierung, da eine fehlende Berechtigungsprüfung in der Download-Funktion wpieprocessfiledownload in der Datei /includes/classes/class-wpie-general.php vorhanden ist. Dies ermöglichte...

sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

CVE-2026-63667

ApostropheCMS versions before 3.6.2 are vulnerable to arbitrary file read via path traversal in the import-export module. The file packages/import-export/lib/formats/gzip.js builds an attachment source path using attacker-controlled _id, name, and extension fields from aposAttachments.json withou...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

EUVD-2026-60441

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2025-15673

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

CVE-2025-15673

The CVE-2025-15673 entry affects the WordPress Import and Export Users and Customers plugin up to version 2.4.3. The root cause is an insufficiently restricted file path when reading and displaying files during CSV imports, enabling a high-privilege user to read arbitrary server files. This impac...

CVE-2026-17566

A flaw was found in pgAdmin 4, a management tool for PostgreSQL databases. The Import/Export Data feature incorrectly processes certain user-provided SQL queries, specifically regarding how backslash characters are interpreted. This vulnerability allows an authenticated remote attacker, with...

CVE-2026-17566

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...

CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...

CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...