{"id":"CVE-2025-60852","aliases":["EUVD-2025-35683","GHSA-592w-453p-rpmg"],"status":"published","title":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600...","description":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00408,"percentile":0.35557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1236"],"published":"2025-10-23T00:00:00Z","modified":"2026-11-05T21:10:00Z","exploits":[{"source":"pocgithub","id":"valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC","title":"valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC","date":"2025-08-27","url":"https://github.com/valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC"}],"references":[{"url":"https://instantdeveloper.com/lp/cloud-freelance/index.html"},{"url":"https://github.com/valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC"},{"url":"https://doc.instantdeveloper.com/eng/default.aspx?artid=a6c69034-d1ee-4057-b19d-40505151ec8e\u0026lang=eng"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60852"},{"url":"https://github.com/advisories/GHSA-592w-453p-rpmg"}],"sources":{"cve":[{"id":"CVE-2025-60852","description":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.","status":"published","published":"2025-10-23T00:00:00Z","modified":"2025-10-23T16:28:33.861Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-35683","description":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.","status":"published","published":"2025-10-23T00:00:00Z","modified":"2025-10-23T16:28:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:38.250854Z"}],"ghsa":[{"id":"GHSA-592w-453p-rpmg","title":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600...","description":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.","status":"published","published":"2025-10-23T15:30:34Z","modified":"2025-10-23T18:32:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1236"],"updated_at":"2026-11-02T15:04:12.076397Z"}],"nvd":[{"id":"CVE-2025-60852","description":"A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.","status":"published","published":"2025-10-23T14:15:42.22Z","modified":"2026-11-05T21:10:00.183Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1236"],"updated_at":"2026-11-05T23:57:15.690201Z"}]}}