Advisories · Technology
webtoffee Export and Import Users and Customers.
Every CVE that names webtoffee Export and Import Users and Customers among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
- webtoffee Export and Import Users and Customers
- CWE-116
- CVSS 4.9 Medium
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
- webtoffee Export and Import Users and Customers
- Path traversal
- CVSS 7.6 High
Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
- webtoffee Export and Import Users and Customers
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
- webtoffee Export and Import Users and Customers
- Insecure deserialization
- CVSS 2.7 Low
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
- webtoffee Export and Import Users and Customers
- Path traversal
- CVSS 7.2 High
Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload
- webtoffee Export and Import Users and Customers
- Unrestricted file upload
- CVSS 7.2 High
Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
- webtoffee Export and Import Users and Customers
- Broken access control