Contact Form 7 To Database Extension Vulnerabilities

CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.

CVSS:

8.6

Affected:

2.10.32 – 2.10.32

Fixed in:

2.10.36

Disclosed:

Apr 9, 2018

CVE-2018-9035 on NVD →

[en] CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.

Affected:

up to 2.10.36

Fixed in:

2.10.36

Disclosed:

Apr 4, 2018

CVE-2018-9035 on NVD →

[en] Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmission...

Affected:

up to 2.8.32

Fixed in:

2.8.32

Disclosed:

Mar 9, 2015

CVE-2015-1874 on NVD →

Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions pag...

CVSS:

4.3

Affected:

up to 2.8.29

Fixed in:

2.8.32

Disclosed:

Mar 4, 2015

CVE-2015-1874 on NVD →

Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.

CVSS:

6.5

Affected:

up to 2.8.26

Fixed in:

2.8.28

Disclosed:

Feb 22, 2015

CVE-2015-2040 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.

Affected:

up to 2.8.28

Fixed in:

2.8.28

Disclosed:

Feb 20, 2015

CVE-2015-2040 on NVD →

The Contact Form DB plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submit_time' and 'form_name' parameters in versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:

6.1

Affected:

up to 2.8.18

Fixed in:

2.8.18

Disclosed:

Nov 26, 2014

This plugin is prone to a reflected cross site scripting vulnerability in Admin Area. Update the plugin.

Affected:

up to 2.8.18

Fixed in:

2.8.18

Disclosed:

Nov 26, 2014

The Contact Form DB plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submit_time' and 'form_name' parameters in versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

Affected:

up to 2.8.18

Fixed in:

2.8.18

Disclosed:

Nov 26, 2014

Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.20 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin....

CVSS:

6.1

Affected:

up to 2.8.19

Fixed in:

2.8.20

Disclosed:

Oct 10, 2014

CVE-2014-7139 on NVD →

[en] Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/a...

Affected:

up to 2.8.20

Fixed in:

2.8.20

Disclosed:

Oct 10, 2014

CVE-2014-7139 on NVD →

The contact-form-7-to-database-extension WordPress plugin was affected by a Reflected XSS in Admin Area security vulnerability.

Affected:

up to 2.8.18

Fixed in:

2.8.18