134 matches found
PT-2019-14055
Name of the Vulnerable Software and Affected Versions WordPress import-users-from-csv-with-meta plugin versions prior to 1.14.2.1 Description The issue allows for directory traversal. Recommendations For versions prior to 1.14.2.1, update to version 1.14.2.1 or later to resolve the issue...
CVE-2019-15326: Improper Limitation of a Pathname to a Restricted Directory
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal...
CVE-2019-15328: Improper Neutralization of Input During Web Page Generation
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS...
CVE-2019-15329: Cross-Site Request Forgery (CSRF)
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF...
CVE-2019-15327: Improper Neutralization of Input During Web Page Generation
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data...
WordPress Import users from CSV with meta plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Import users from CSV with meta is used in one of the import users plugin. A cross-site request forgery vulnerability exists in the...
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
PT-2019-13779 · WordPress · Import-Users-From-Csv-With-Meta
Name of the Vulnerable Software and Affected Versions: Import users from CSV with meta plugin versions prior to 1.14.2.2 Description: The issue allows for a CSRF attack via the "wp-admin/admin-ajax.php?action=acui delete attachment" API endpoint. This affects the "Import users from CSV with meta"...
CVE-2019-14683: Cross-Site Request Forgery (CSRF)
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-10264
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE...
PT-2019-11669
Name of the Vulnerable Software and Affected Versions Ahsay Cloud Backup Suite versions prior to 8.1.1.50 Description An issue was discovered that allows for XXE triggering through the Import Users option on the "Move / Import / Export Users" screen, which accepts a ZIP archive containing a...
CVE-2019-10264: Improper Restriction of XML External Entity Reference
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE...
WordPress Import users from CSV with meta plugin <= 1.14.1.3 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress Import users from CSV with meta plugin versions = 1.14.1.3. Solution Update the WordPress Import users from CSV with meta plugin to the latest available version at least 1.14.2.2...
Import users from CSV with meta <= 1.14.1.3 - CSRF leading to attachment deletion & Path Traversal
CSRF leading to attachment deletion via the acuideleteattachment AJAX function...
osTicket 1.11 Cross Site Scripting / Local File Inclusion
Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Date: 09.04.2019 Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link: https://github.com/osTicket/osTicket References:...
PT-2019-12361
Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12 Description The issue exists due to the possibility of XSS via several API endpoints, including "/upload/file.php", "/upload/scp/users.php?do=import-users", and "/upload/scp/ajax.php/users/import", when an agent...