CVE-2022-1194

CVE-2022-1194: Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

Vendor Unknown

Product Mobile Events Manager

Weakness CWE-1236

Published September 16, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.

Key dates

02Disclosure timeline

September 16, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1194 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html

Related vulnerabilities

04Related CVE

CVE-2021-41270 CSV Injection in Symfony CVE-2022-46802 WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection CVE-2022-46801 WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection CVE-2023-3527 Avaya Call Management System CSV injection vulnerability CVE-2022-45810 WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection