# webtoffee Export and Import Users and Customers.

Every CVE that names webtoffee Export and Import Users and Customers among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field](https://agentprime.io/advisories/CVE-2026-104368.md)
  `CVE-2026-104368` · CVE record: webtoffee Export and Import Users and Customers · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-116
- [Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function](https://agentprime.io/advisories/CVE-2025-1973.md)
  `CVE-2025-1973` · CVE record: webtoffee Export and Import Users and Customers · CVSS 4.9 Medium · Not analysed yet · Published 22 Mar 2025 · Tags: Path traversal
- [Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function](https://agentprime.io/advisories/CVE-2025-1970.md)
  `CVE-2025-1970` · CVE record: webtoffee Export and Import Users and Customers · CVSS 7.6 High · Not analysed yet · Published 22 Mar 2025 · Tags: Server-side request forgery (SSRF)
- [Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter](https://agentprime.io/advisories/CVE-2025-1971.md)
  `CVE-2025-1971` · CVE record: webtoffee Export and Import Users and Customers · CVSS 7.2 High · Not analysed yet · Published 22 Mar 2025 · Tags: Insecure deserialization
- [Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function](https://agentprime.io/advisories/CVE-2025-1972.md)
  `CVE-2025-1972` · CVE record: webtoffee Export and Import Users and Customers · CVSS 2.7 Low · Not analysed yet · Published 22 Mar 2025 · Tags: Path traversal
- [Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload](https://agentprime.io/advisories/CVE-2023-6558.md)
  `CVE-2023-6558` · CVE record: webtoffee Export and Import Users and Customers · CVSS 7.2 High · Not analysed yet · Published 11 Jan 2024 · Tags: Unrestricted file upload
- [Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change](https://agentprime.io/advisories/CVE-2023-3459.md)
  `CVE-2023-3459` · CVE record: webtoffee Export and Import Users and Customers · CVSS 7.2 High · Not analysed yet · Published 18 Jul 2023 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=webtoffee-export-and-import-users-and-customers>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/webtoffee-export-and-import-users-and-customers/>. Everything for agents: <https://agentprime.io/llms.txt>.