CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- mobileeventsmanager mobile events managerMobile Events Manager < 1.4.8 - Admin+ CSV Injection8.8 High
- leogermani wp users exporter, wp-users-exporter project wp-users-exporter +1 moreWP Users Exporter <= 1.4.2 - CSV Injection6.5 Medium
- homescript ultimate sms notifications for woocommerceUltimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection6.5 Medium
- emarket-design request a quoteRequest a Quote <= 2.3.7 - CSV Injection8.8 High
- exports and reports project and reports, unknown exports and reports +1 moreExports and Reports < 0.9.2 - Contributor+ CSV Injection8.8 High
- soflyy wp all import, unknown import any xml or csv file to wordpress +1 moreWP All Import < 3.6.8 - Admin+ Arbitrary File Upload7.2 High
- inventree inventree/inventree, inventree project inventree +1 moreImproper Neutralization of Formula Elements in a CSV File in inventree/inventree9.0 Critical
- usabilitydynamics wp-crm, unknown wp-crm – customer relations management for wordpress +1 moreWP-CRM <= 1.2.1 - CSV Injection7.8 High
- kromit titra, kromitgmbh kromitgmbh/titra +1 moreImproper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra8.0 High
- sevone network management system, ibm sevone network performance management +1 moreSevOne Network Management System Device Manager Page injection6.3 Medium
- dell powerstore, powerstoreos +1 morePowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The...5.9 Medium
- csv-safe project csv-safeCSV-Safe improperly filters special characters potentially leading to CSV injection9.8 Critical
- luya yii-helpers, luyadev luyadev/yii-helpers +1 moreFormula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers8.0 High
- invicti acunetixInvicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page...8.8 High
- eaton intelligent power manager infrastructure (ipm infrastructure), intelligent power manager +1 moreSecurity issues in Eaton Intelligent Power Manager Infrastructure5.7 Medium
- mantisbtMantisBT CSV Injection unprivileged user access in csv_export.php7.8 High
- unknown visual form builderVisual Form Builder < 3.0.6 - CSV Injection9.8 Critical
- kimaiImproper Neutralization of Formula Elements in a CSV File in Kimai 27.8 High
- ruoyiRuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx...7.8 High
- surveyking project surveykingSurvey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers...9.8 Critical
- gradio-app gradioImproper Neutralization of Formula Elements in a CSV File in Gradio Flagging8.8 High
- ibm guardium data encryption, security guardium data encryption +1 moreIBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a...6.2 Medium
- magnolia-cms magnolia cmsArbitrary code execution in Magnolia CMS7.8 High
- broadcom ca harvest software change managerCA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a...8.8 High
- nocodbNocoDB - CSV Injection in User Management8.0 High
- html-to-csv project html-to-csvImproper Input Validation5.6 Medium
- sensiolabs symfony, fedoraproject fedora +1 moreCSV Injection in Symfony6.5 Medium
- dell cloudlink, emc cloud link +1 moreDell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A...5.9 Medium
- delta electronics dialinkDelta Electronics DIALink5.9 Medium
- maharaIn Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain...7.8 High
- connections-pro connections business directoryConnections Business Directory < 9.7 - Admin+ CSV Injection8.0 High
- huawei imanager neteco, imanager neteco 6000, manageone +2 moreThere is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An...6.8 Medium
- sap business oneSAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to...9.8 Critical
- fortinet fortimanagerAn improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4...3.7 Low
- craftcms craft cmsCSV Injection Vulnerability8.8 High
- salesagility suitecrmSuiteCRM - CSV Injection in Accounts Module8.0 High
- shuupShuup - Formula Injection in Checkout Addresses8.0 High
- perforce puppet enterprise, puppet enterprise +1 morePuppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.8.8 High
- pimcoreImproper Neutralization of Formula Elements in a CSV File in pimcore/pimcore8.0 High
- zohocorp manageengine adselfservice plusA CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1...8.8 High
- schneider-electric easergy t300 firmwareA CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in...7.3 High
- bookingcore booking coreThe “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV...7.8 High
- fetch designs sign-up sheetsSign-up Sheets < 1.0.14 - Authenticated CSV Injection8.0 High
- akauntingAkaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function....8.8 High
- blackberry unified endpoint managementA Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM...7.3 High
- ibm spectrum scaleIBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to...7.0 High
- cisco umbrella, umbrella insights virtual appliance +1 moreCisco Umbrella Link and CSV Formula Injection Vulnerabilities6.5 Medium
- cisco umbrella, umbrella insights virtual appliance +1 moreCisco Umbrella Link and CSV Formula Injection Vulnerabilities6.5 Medium
- ciphercoin contact form 7 database addonContact Form 7 Database Addon < 1.2.5.6 - CSV Injection7.8 High
- bigprof online invoicing systemA CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be...4.4 Medium
- Show moreLoading…