CVE-2025-9241 elunez eladmin exportUser csv injection

A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited...

CVE-2025-9241

CVE-2025-9241 affects elunez eladmin up to version 2.7. The vulnerability resides in the exportUser function, which does not escape/export CSV content, enabling CSV injection. Exploitation can be remote and public exploits exist. Multiple connected sources corroborate the issue and identify the s...

PT-2025-34151 · Unknown · Elunez Eladmin

Name of the Vulnerable Software and Affected Versions: elunez eladmin versions prior to 2.8 Description: A weakness has been identified in the exportUser function, which can lead to CSV injection. The attack can be initiated remotely and the exploit has been made publicly available...

📄 nopCommerce 4.10 / 4.80.3 CSV Injection

nopCommerce versions 4.10 and 4.80.3 are vulnerable to CSV injection Formula Injection when exporting data to CSV. The application does not properly sanitize user-supplied input before including it in CSV export files. nopCommerce versions v4.10 and v4.80.3 are vulnerable to CSV Injection Formula...

Linux Distros Unpatched Vulnerability : CVE-2020-8518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. CVE-2020-8518 Note that Nessus...

Design and Implementation of a Controlled Ransomware Framework for Educational Purposes Using Flutter Cryptographic APIs on Desktop PCs and Android Devices

This study focuses on the creation and implementation of ransomware for educational purposes that leverages Python's native cryptographic APIs in a controlled environment. Additionally, an Android version of the framework is implemented using Flutter and Dart. For both versions, open-source...

WordPress AnWP Football Leagues plugin code execution vulnerability

WordPress AnWP Football Leagues plugin is designed for WordPress website soccer tournament management plugin, support a variety of tournament modes such as knockout, round-robin, etc., including player data management, scheduling, match results statistics and other features. A code execution...

MAL-2025-34754 Malicious code in terser-module-csv-promise (npm)

The package terser-module-csv-promise was found to contain malicious code...

CVE-2025-8767

The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'downloadcsvplayers' and 'downloadcsvgames' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CVE-2025-8808

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-module-admin/user/ajax/save of the component com.jeff.tianti.controller. The manipulation leads to csv injection. The attack may be initiated...

CVE-2025-8767

The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'downloadcsvplayers' and 'downloadcsvgames' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed...

CVE-2025-8767 AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection

The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'downloadcsvplayers' and 'downloadcsvgames' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed...

CVE-2025-8767

The CVE-2025-8767 entry concerns the WordPress plugin AnWP Football Leagues. Affected versions are up to and including 0.16.17, with CSV injection in the functions download_csv_players and download_csv_games. Exploitation requires authenticated access at Administrator level or higher. An attacker...

WordPress plugin AnWP Football Leagues 安全漏洞

WordPress AnWP Football Leagues plugin is designed for WordPress website soccer tournament management plugin, support a variety of tournament modes such as knockout, round-robin, etc., including player data management, scheduling, match results statistics and other features. A code execution...

PT-2025-32633 · WordPress · Anwp Football Leagues

Name of the Vulnerable Software and Affected Versions: AnWP Football Leagues plugin for WordPress versions up to and including 0.16.17 Description: The AnWP Football Leagues plugin for WordPress is susceptible to CSV injection through the download csv players and download csv games functions...

CVE-2025-8808 xujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injection

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-module-admin/user/ajax/save of the component com.jeff.tianti.controller. The manipulation leads to csv injection. The attack may be initiated...

PT-2025-32482 · Unknown · Xujeff Tianti 天梯

Name of the Vulnerable Software and Affected Versions: xujeff tianti 天梯 versions prior to 2.3 Description: A problematic issue exists in xujeff tianti 天梯. The exportOrder function within the /tianti-module-admin/user/ajax/save file of the com.jeff.tianti.controller component is susceptible to CSV...

tianti 安全漏洞

tianti tianti is a JAVA lightweight CMS solution by jeffry personal developer. A security vulnerability exists in tianti 2.3 and earlier versions, which originates from the function exportOrder in the file /tianti-module-admin/user/ajax/save resulting in a CSV injection that could lead to a remot...