mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-29 16:29:28 +02:00
0xMarcio
1.0 KiB
1.0 KiB
CVE-2025-8767
Description
The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and 'download_csv_games' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
POC
Reference
No PoCs from references.