Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,468 results · page 19 of 30
Dec 5, 2022Advanced Import: Does not have CSRF checkCVE-2022-3677 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks
- Product
- Advanced Import
- Fixed in
- 1.3.8
- What to do
- Update Advanced Import to 1.3.8 or newer.
Dec 5, 2022PostmagThemes Demo Import: Does not validate the imported fileCVE-2022-1540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
- Product
- PostmagThemes Demo Import
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update PostmagThemes Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 1, 2022A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 1CVE-2022-3709 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 6.8
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UCVE-2022-3920 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Nov 15, 2022A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, CVE-2022-20938 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to insufficient validation of the XML syntax when importing a module. An attacker could exploit this vulnerability by supplying a specially crafted XML file to the function. A successful exploit could allow the attacker to read sensitive data that would normally not be revealed.
- Product
- Cisco Firepower Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 15, 2022Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon CVE-2022-25743 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comqualcomm.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.CVE-2022-43491 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 7, 2022Import any XML or CSV File to: Is not properly filteringCVE-2022-3418 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Nov 1, 2022Use after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox CVE-2022-3311 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Use after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 31, 2022Customizer Export/Import: Unserializes the content of an imported fileCVE-2022-3380 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Customizer Export/Import
- Fixed in
- 0.9.5
- What to do
- Update Customizer Export/Import to 0.9.5 or newer.
Oct 31, 2022Ocean Extra: Unserialises the content of an imported fileCVE-2022-3374 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Ocean Extra
- Fixed in
- 2.0.5
- What to do
- Update Ocean Extra to 2.0.5 or newer.
Oct 31, 2022PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro: Unserializes the content of imported filesCVE-2022-3366 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
- Product
- PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro
- Fixed in
- 2.5.2
- What to do
- Update PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro to 2.5.2 or newer.
Oct 31, 2022Smart Slider 3: Unserialises the content of an imported fileCVE-2022-3357 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.
- Product
- Smart Slider 3
- Fixed in
- 3.5.1.11
- What to do
- Update Smart Slider 3 to 3.5.1.11 or newer.
Oct 31, 2022Easy WP SMTP: Unserialises the content of an imported fileCVE-2022-3334 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Easy WP SMTP
- Fixed in
- 1.5.0
- What to do
- Update Easy WP SMTP to 1.5.0 or newer.
Oct 25, 2022Kadence WooCommerce Email Designer: Unserialises the content of an imported fileCVE-2022-3335 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Kadence WooCommerce Email Designer
- Fixed in
- 1.5.7
- What to do
- Update Kadence WooCommerce Email Designer to 1.5.7 or newer.
Oct 25, 2022An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0.CVE-2022-34850 · Other software · Robustel · reported by talos-cna@cisco.comHigh 7.2
An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- R1510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 20, 2022An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code viCVE-2022-31366 · Other software · Eve-ng · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
- Product
- Eve-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorderpaciocco.github.ioerpaciocco.github.io
Oct 19, 2022OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.CVE-2022-43023 · Other software · Opencats · reported by MITREMedium 6.5
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate CVE-2022-43413 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins Job Import Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 17, 2022An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.CVE-2022-3067 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022Import all XML, CSV & TXT: Does not have authorisation in some placesCVE-2022-3244 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce
- Product
- Import all XML, CSV & TXT
- Fixed in
- 6.5.8
- What to do
- Update Import all XML, CSV & TXT to 6.5.8 or newer.
Oct 17, 2022Import all XML, CSV & TXT: Does not properly sanitise and escape imported data before using them back SQL statementsCVE-2022-3243 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- Product
- Import all XML, CSV & TXT
- Fixed in
- 6.5.8
- What to do
- Update Import all XML, CSV & TXT to 6.5.8 or newer.
Oct 3, 2022A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated usCVE-2022-36551 · Other software · Heartex · reported by MITREMedium 6.5
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.
- Product
- Label Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabelstud.iopacketstormsecurity.com
Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.13
- What to do
- Update Ninja Forms Contact Form to 3.6.13 or newer.
Sep 21, 2022Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.CVE-2022-36386 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 19, 2022UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.CVE-2022-38527 · Other software · Ucms Project · reported by MITREMedium 6.1
UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.
- Product
- Ucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containCVE-2022-38845 · Other software · Espocrm · reported by MITREMedium 6.1
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022WP Taxonomy Import: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Taxonomy Import
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP Taxonomy Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2022Windows Photo Import API Elevation of Privilege VulnerabilityCVE-2022-26928 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows Photo Import API Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 6, 2022Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes.CVE-2022-38528 · Other software · Assimp · reported by MITREMedium 6.5
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,CVE-2021-35135 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.2
A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 12, 2022In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input vCVE-2022-20266 · Computers, phones & browsers · Google · reported by security@android.comMedium 5
In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-211757348
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 25, 2022The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions.CVE-2022-35650 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jul 25, 2022This affects all versions of package node-import.CVE-2020-7678 · Other software · Node-import Project · reported by report@snyk.ioHigh 8.6
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
- Product
- Node-import
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 17, 2022Import CSV Files: Does not sanitise and escaped imported data before outputting them back in a pageCVE-2022-2146 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting
- Product
- Import CSV Files
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Import CSV Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 14, 2022The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacCVE-2022-2406 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 12, 2022A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatCVE-2022-34467 · Other software · Siemens · reported by productcert@siemens.comMedium 6.5
A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component.
- Product
- Mendix Excel Importer Module (Mendix 8 compatible)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jul 11, 2022WooCommerce - Product Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WooCommerce - Product Importer
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update WooCommerce - Product Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 5, 2022A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4.CVE-2022-30289 · Other software · Citeum · reported by MITREMedium 5.4
A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location.
- Product
- Opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenisa.europa.eu
Jul 4, 2022Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2022-2268 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.8
- What to do
- Update Import any XML or CSV File to to 3.6.8 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
- Product
- Import Export All WordPress Images, Users & Post Types
- Fixed in
- 6.5.3
- What to do
- Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Jun 27, 2022Ultimate WooCommerce CSV Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1470 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Ultimate WooCommerce CSV Importer
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Ultimate WooCommerce CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2022In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality.CVE-2022-23071 · Other software · recipes · reported by vulnerabilitylab@mend.ioMedium 6.5
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validatiCVE-2022-30075 · Network & remote access · Tp-link · reported by MITREHigh 8.8
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
- Product
- Archer Ax50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 3, 2022In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution.CVE-2022-32270 · Other software · Realnetworks · reported by MITRECritical 9.8
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).
- Product
- Realplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022External Media without Import: Does not have any authorisation and does to ensure that medias added via URLs are external mediasCVE-2022-1398 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
- Product
- External Media without Import
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.