CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- liquidweb event ticketsCSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists...8.8 High
- lenovo xclarity administrator (lxca), xclarity administrator +1 moreA stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA)...4.8 Medium
- webtoffee import export wordpress usersThe webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress...7.3 High
- uipath orchestratorUiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log...5.5 Medium
- enhancesoft osticketAn issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula)...8.8 High
- joget worfklow** DISPUTED ** In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists,...7.8 High
- mytinytodomyTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.9.8 Critical
- livezillaLiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.8.8 High
- ibm maximo asset management, control desk, maximo for aviation +7 more +9 moreIBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote...5.5 Medium
- sahipro sahi proAn issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has ...8.8 High
- joomla joomla\!An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable...9.8 Critical
- workdayCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in...8.8 High
- incsub hustleThe Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it...8.8 High
- projectsendCSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data...8.8 High
- ibm spectrum control standard edition, spectrum control, tivoli storage productivity center +2 moreIBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2...6.8 Medium
- alkacon opencmsAlkacon OpenCMS CSV Injection via New User module7.8 High
- symantec endpoint protection, symantec corporation endpoint protection (mac client) +1 moreSEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to...6.3 Medium
- recon-ng project recon-ngAn issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv...9.8 Critical
- ibm api connectIBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the...8.9 High
- dokuwiki** DISPUTED ** CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins...9.6 Critical
- phpmyfaqThe admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.7.2 High
- ninjaforms ninja formsThe Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.8.6 High
- opswat metadefenderOPSWAT MetaDefender before v4.11.2 allows CSV injection.7.8 High
- export users to csv project users to csvThe Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.8.6 High
- webtoffee wordpress comments import and exportThe plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable...7.8 High
- algolplus advanced order export for woocommerceThe plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is...7.8 High
- cirt.net niktoCSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject...9.8 Critical
- codeslab shopy point of saleA CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with...8.8 High
- hrsale project hrsaleA CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user...8.8 High
- clustercoding blog master proA CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a...8.8 High
- web-dorado form makerThe WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.7.8 High
- open-auditOpen-AudIT before 2.2 has CSV Injection.6.8 Medium
- mauticCSV Injection vulnerability with exported contact lists in Mautic9.8 Critical
- contact-form-7-to-database-extension project contact-form-7-to-database-extensionCSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension...9.6 Critical
- acyba acymailingCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in...8.8 High
- acyba acysmsCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in...8.8 High
- tikiTiki 17.1 does not validate user input for special characters; consequently, a CSV Injection...8.8 High