CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- 8blocks 1003 mortgage applicationWordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection6.1 Medium
- givewpWordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection4.7 Medium
- kb support support, kbsupport kb support +1 moreWordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection8.8 High
- ayecode userswpWordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection5.8 Medium
- pär thernström simple history – user activity log, audit tool, simple-history simple history +1 moreWordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection3.0 Low
- dell smartfabric storage softwareDell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML...4.4 Medium
- searchbloxCVE-2020-101319.8 Critical
- ibm infosphere information serverIBM InfoSphere Information Server CSV injection7.0 High
- atlosAn issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted...8.0 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreImproper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq8.8 High
- tadiran telecom composit, tadirantele aeonix +1 moreTadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File7.3 High
- nokia netactAn issue was discovered in Nokia NetAct 22 through the Administration of Measurements website...8.8 High
- avaya call management systemAvaya Call Management System CSV injection vulnerability6.8 Medium
- ibm watson knowledge catalog on cloud pak for dataIBM Watson Knowledge Catalog CSV injection7.0 High
- fossbilling, fossbilling fossbilling/fossbilling +1 moreImproper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling7.7 High
- ericsson network managerEricsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the...6.8 Medium
- admidio, admidio admidio/admidio +1 moreImproper Neutralization of Formula Elements in a CSV File in admidio/admidio6.6 Medium
- sage x3Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.7.2 High
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection8.3 High
- minicalMinical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to...8.8 High
- pimcore pimcore/customer-data-framework, customer management framework +1 moreImproper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework5.0 Medium
- rosariosisRosarioSIS vulnerable to CSV Injection5.4 Medium
- churchcrmChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and...7.8 High
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io8.8 High
- sap application interface framework (message dashboard), application interface framework, basis +2 more +4 moreCode Injection vulnerability in SAP Application Interface Framework (Message Dashboard)4.4 Medium
- fortinet fortianalyzerA improper neutralization of formula elements in a CSV file vulnerability in Fortinet...4.0 Medium
- ibm maximo asset management, maximo manage, maximo application suite +2 moreIBM Maximo Application Suite command injection5.5 Medium
- wecube-platform project wecube-platformAn issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the ...6.3 Medium
- unknown wp csv exporter, wp csv exporter project csv exporter +1 moreWP CSV Exporter < 1.3.7 - CSV Injection7.8 High
- dwbooster appointment hour booking, codepeople appointment hour booking – booking calendar +1 moreAppointment Hour Booking <= 1.3.72 - CSV Injection5.8 Medium
- team johnlong software co., ltd. maild mail server, raidenmaild +1 moreTEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection8.0 High
- piwebsolution export customers list csv for woocommerce, unknown export customers list csv for woocommerce, wordpress users csv, export guest customer list +1 moreExport customers list CSV for WooCommerce < 2.0.69 - CSV Injection9.8 Critical
- event registration application project registration applicationSourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection...7.8 High
- ciphercoin contact form 7 database addonContact Form 7 Database Addon < 1.2.6.5 - CSV Injection9.8 Critical
- awesomemotive easy digital downloads, easy digital downloads digital downloads +1 moreEasy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection9.8 Critical
- metagauss profilegrid, profilegrid (wordpress plugin) +1 moreWordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability6.8 Medium
- unknown wpforms pro, wpforms pro +1 moreWPForms Pro < 1.7.7 - CSV Injection9.8 Critical
- activity log project log, activity log team log (wordpress plugin) +1 moreWordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability7.4 High
- carazo import and export users and customersImport and export users and customers < 1.20.5 - Subscriber+ CSV Injection8.0 High
- fluentforms contact form, contact form - wpmanageninja llc form plugin – fastest contact form builder plugin for wordpress by fluent forms, unknown contact form plugin – fastest contact form builder plugin for wordpress by fluent forms +2 moreFluentForm < 4.3.13 - CSV Injection9.8 Critical
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to...6.6 Medium
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote...9.8 Critical
- php point of sale point of sale, phppointofsale php point of sale +1 moreCSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC8.8 High
- bestwebsoft post to csv, unknown post to csv by bestwebsoft +1 morePost to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection9.8 Critical
- zktec zkbio timeZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to...8.0 High
- apasionados export post info, export post info (wordpress plugin) +1 moreWordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability6.2 Medium
- ghas-to-csv project ghas-to-csvImproper Neutralization of Formula Elements in a CSV File in ghas-to-csv5.8 Medium
- espocrmCSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system...8.0 High
- espocrmCross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious...6.1 Medium
- mra13 affiliates managerAffiliates Manager < 2.9.14 - Affiliate CSV Injection8.0 High
- Show moreLoading…