CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- taigaio taiga frontA CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via...8.8 High
- snipeitapp snipe-itAn issue in Snipe-IT v.7.0.13 build 15514 allows a remote attacker to escalate privileges via the...8.0 High
- hikvision hikcentral master lite, hikcentral master +1 moreThere is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an...5.5 Medium
- ibm aspera consoleIBM Aspera Console CSV injection8.0 High
- refuel autolabelRefuel Autolab Eval Injection vulnerability7.8 High
- refuel autolabelRefuel Autolab Eval Injection vulnerability7.8 High
- automationanywhere automation 360A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows...7.8 High
- tenable identity exposureFormula Injection Vulnerability7.6 High
- fortinet fortiaiopsAn improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in...5.1 Medium
- businessdirectoryplugin business directory, strategy11team business directory plugin, business directory plugin – easy listing directories for wordpress +2 moreBusiness Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection7.4 High
- westguardsolutions ws form, westguard ws form lite – drag & drop contact form builder, ws form pro +2 moreWS Form LITE <= 1.9.217 - Unauthenticated CSV Injection4.7 Medium
- ibm websphere automation, websphere automation for ibm cloud pak for watson aiops +1 moreIBM WebSphere Automation CSV injection6.5 Medium
- combodo itopiTop vulnerable to potential formula injection in Excel/CSV export file8.0 High
- comesio relevanssi – a better search, relevanssi, relevanssi premium +1 more +3 moreRelevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection5.8 Medium
- ericsson network managerEricsson Network Manager - Improper Neutralization of Formula Elements Vulnerability7.1 High
- No product listedCSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute...9.8 Critical
- fortinet forticlientems, forticlient endpoint management server +1 moreA improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7...8.7 High
- thinkst canarytokensCSV Injection in exported history CSV files6.5 Medium
- ibm cloud pak for automation, cloud pak for business automation +1 moreIBM Cloud Pak for Automation CSV injection7.0 High
- ailux imx6, imx6 bundle +1 moreA CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the ...5.9 Medium
- koha, koha-community koha library software +1 moreCSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in...8.0 High
- ncr terminal handlerAn issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a...6.5 Medium
- unknown contact form entries, crmperks database for contact form 7\, wpforms\, elementor forms +1 moreContact Form Entries < 1.3.0 - CSV Injection7.8 High
- sesami cash point \& transport optimizerCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (...5.3 Medium
- sesami cash point \& transport optimizerCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (...7.5 High
- sesami cash point \& transport optimizerCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (...7.5 High
- activeadmin active adminActiveAdmin CSV Injection leading to sensitive information disclosure9.8 Critical
- activeadminPotential CSV export data leak6.5 Medium
- phpjabbers availability booking calendarAvailability Booking Calendar 5.0 allows CSV injection via the unique ID field in the...8.8 High
- ibm security guardiumIBM Security Guardium CSV injection8.0 High
- corebosCorebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject...8.0 High
- wpwax directorist, directorist – wordpress business directory plugin with classified ads listings +1 moreWordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection5.1 Medium
- kaushik kalathiya export users data csv, kaushikkalathiya export users data +1 moreWordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection7.6 High
- kigurumi csv exporter, nakashima masahiro wp csv exporter +1 moreWordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection5.8 Medium
- shambix simple csv/xls exporter, simple csv\/xls exporter +1 moreWordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection5.8 Medium
- patrick robrecht posts and users statsWordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection5.8 Medium
- solwin infotech user blockerWordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection5.9 Medium
- coffee2code commenter emailsWordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection4.7 Medium
- webtoffee wordpress comments import & export, wordpress comments import and export +1 moreWordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection6.1 Medium
- anmari amr usersWordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection5.8 Medium
- icegram express – email marketing, newsletters and automation for wordpress & woocommerce, express +1 moreWordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection6.1 Medium
- jackmail, jackmail & sarbacane emails & newsletters with jackmail +1 moreWordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection5.8 Medium
- narola infotech solutions llp export users data distinctWordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection5.8 Medium
- noptin, noptin newsletter simple newsletter plugin – noptin +1 moreWordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection6.1 Medium
- reviewx – multi-criteria rating & reviews for woocommerce, wpdeveloper reviewx, reviewx – multi-criteria rating & reviews for woocommerce +2 moreWordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection6.1 Medium
- geminilabs site reviewsWordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection6.1 Medium
- webtoffee product reviews import export for woocommerceWordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection6.1 Medium
- bestwebsoft post to csv by bestwebsoft, post to csv +1 moreWordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection4.7 Medium
- muneeb form builder | create responsive contact forms, web-settler form builder +1 moreWordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection4.7 Medium
- wpeka wp cookie consent, wpeka-club wp cookie consent ( for gdpr, ccpa & eprivacy ) +1 moreWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection4.0 Medium
- Show moreLoading…