CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3634 – Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection
https://notcve.org/view.php?id=CVE-2022-3634
27 Oct 2022 — The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection El complemento de WordPress del complemento de base de datos Contact Form 7 anterior a 1.2.6.5 no valida los datos cuando los devuelve a un archivo CSV, lo que podría provocar una inyección de CSV. The Contact Form 7 Database Addon plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.2.6.3. This allows attackers to em... • https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36885 – WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36885
12 Nov 2021 — Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1). Se ha detectado una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado sin autenticación en el plugin Contact Form 7 Database Addon – CFDB7 de WordPress (versiones anteriores a 1.2.6.1 incluyéndola) • https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-6-1-unauthenticated-stored-cross-site-scripting-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36886 – WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2021-36886
12 Nov 2021 — Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) detectada en el plugin Contact Form 7 Database Addon - CFDB7 de WordPress (versiones a 1.2.5.9 incluyéndola) • https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-5-9-cross-site-request-forgery-csrf-vulnerability • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24144 – Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection
https://notcve.org/view.php?id=CVE-2021-24144
25 Jan 2021 — Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files. Una entrada no comprobada en el plugin Contact Form 7 Database Addon, versiones anteriores a 1.2.5.6, era propensa a una vulnerabilidad que permite a atacantes remotos inyectar fórmulas arbitrarias en archivos CSV • https://wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •