CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- prestashopCSV Injection via csv export6.8 Medium
- aida64Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary...7.8 High
- huawei manageoneThere has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may...4.9 Medium
- phplistphpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.9.8 Critical
- huawei imanager neteco 6000There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker...7.8 High
- solarwinds webhelpdeskSolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file...6.5 Medium
- openasset digital asset managementOpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls...5.3 Medium
- ibm resilient, resilient security orchestration automation and response +1 moreIBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system,...6.8 Medium
- ibm cloud pak for securityIBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote...6.5 Medium
- netskopeA CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated...7.8 High
- salesagility suitecrmSuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts,...7.8 High
- ibm filenet content managerIBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote...7.0 High
- b. braun melsungen ag onlinesuite, bbraun onlinesuite application package +1 moreB. Braun OnlineSuite7.8 High
- marmindA CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application...7.8 High
- mind imind serverCSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.8.8 High
- jomsocialJomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.9.8 Critical
- easyregistrationforms easy registration formsEasy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry...8.8 High
- codection import and export users and customersImport and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via...8.0 High
- weformspro weformsWeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.9.8 Critical
- phpmyadminphpMyAdmin through 5.0.2 allows CSV injection via Export Section8.8 High
- getgophish gophishGophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.7.8 High
- anuko time tracker, timetracker +1 moreCSV injection in Anuko Time Tracker8.7 High
- ibm security guardiumIBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could...6.8 Medium
- ibm cognos analyticsIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the...5.5 Medium
- ozeki ng sms gatewayCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts...8.8 High
- philips patient information center ix (picix), patient information center ix +1 morePhilips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV File5.0 Medium
- i-doitA CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an...8.8 High
- [unknown] cloudforms, redhat cloudforms management engine +1 moreRed Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update6.3 Medium
- nozominetworks guardianNozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.7.3 High
- booleboxBooleBox Secure File Sharing Utility (potentially all versions) allows CSV injection via a...7.3 High
- mattermost serverMattermost Server is vulnerable CSV Injection9.8 Critical
- edx open edx platformStudio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor...8.8 High
- solarwinds webhelpdeskFormula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value ...7.8 High
- search meter project meterThe Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search...9.8 Critical
- auth0 login by auth0An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous...9.8 Critical
- arxes-tolinaA CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other...9.6 Critical
- zohocorp manageengine password manager proZoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability...9.8 Critical
- chadhaajay phpkbadmin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi...4.9 Medium
- codepeople appointment booking calendarThe Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields...7.8 High
- export users to csv project users to csvThe Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.6.1 Medium
- litecartLiteCart through 2.2.1 allows CSV injection via a customer's profile.8.0 High
- keepassKeePass 2.4.1 allows CSV injection in the title field of a CSV export.7.8 High
- tablepressThe TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.6.8 Medium
- solarwinds serv-u ftp serverA CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.6.5 Medium
- sap enable nowSAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files,...9.8 Critical
- ibm cloud pak systemPlatform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A...7.0 High
- lenovo xclarity controller (xcc), xclarity controller +1 moreA stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could...6.5 Medium
- admincolumns admin columnsA CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress...8.8 High
- pivotal apps manager, pivotal software application service +1 moreCSV Injection in usage report downloaded from Pivotal Application Manager3.5 Low
- limesurveyA CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey...9.8 Critical
- Show moreLoading…