{"id":"CVE-2022-2798","state":"PUBLISHED","title":"Affiliates Manager < 2.9.14 - Affiliate CSV Injection","description":"The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data","publishedAt":"2022-09-16T08:40:34.000Z","updatedAt":"2024-08-03T00:46:04.536Z","severity":null,"assigner":"WPScan","products":["Unknown Affiliates Manager"],"affected":[{"vendor":"Unknown","product":"Affiliates Manager","versions":[{"version":"2.9.14","status":"affected","lessThan":"2.9.14","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd"],"weaknesses":["CWE-1236"],"ingestedAt":"2026-10-29T19:50:01.354Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/2xxx/CVE-2022-2798.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-2798","state":"PUBLISHED","datePublished":"2022-09-16T08:40:34.000Z","dateUpdated":"2024-08-03T00:46:04.536Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-08-12T00:00:00.000Z"},"containers":{"cna":{"title":"Affiliates Manager < 2.9.14 - Affiliate CSV Injection","descriptions":[{"lang":"en","value":"The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data"}],"affected":[{"vendor":"Unknown","product":"Affiliates Manager","versions":[{"version":"2.9.14","status":"affected","lessThan":"2.9.14","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1236","description":"CWE-1236 Improper Neutralization of Formula Elements in a CSV File","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-09-16T08:40:34.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"nhatnam"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-2798","STATE":"PUBLIC","TITLE":"Affiliates Manager < 2.9.14 - Affiliate CSV Injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Affiliates Manager","version":{"version_data":[{"version_affected":"<","version_name":"2.9.14","version_value":"2.9.14"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"nhatnam"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-1236 Improper Neutralization of Formula Elements in a CSV File"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd","refsource":"MISC","url":"https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T00:46:04.536Z"}}]}}}