CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- maurosoria dirsearchdirsearch 0.4.1 - CSV Injection5.1 Medium
- guelfoweb knock, knockpy +1 moreKnockpy 4.1.1 - CSV Injection5.3 Medium
- hustojHUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export5.2 Medium
- trueconf serverA CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to...7.3 High
- phpmyfaqphpMyFAQ 3.1.12 CSV Injection via User Profile Export6.2 Medium
- rukovoditelRukovoditel 3.3.1 CSV Injection via User Account Export6.2 Medium
- projectsendProjectSend r1605 CSV Injection via User Account Export Functionality6.2 Medium
- code-projects inventory management systemSourceCodester Inventory Management System SVC Report Export csv injection5.1 Medium
- hcltech unicaCSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.7.5 High
- vaniivan simple user import exportSimple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection6.6 Medium
- axosoft scrum and bug trackingAxosoft Scrum and Bug Tracking Edit Ticket csv injection5.3 Medium
- newcodebyte ai chatbot free models – customer support, live chat, virtual assistantAI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection4.3 Medium
- No product listedA CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600...6.5 Medium
- bestpractical request trackerBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via...2.6 Low
- bagistobagisto - CSV Formula Injection in Create New Product7.1 High
- b&r industrial automation gmbh automation runtimeCSV Formula Injection Vulnerability5.3 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection4.3 Medium
- axosoft scrum and bug trackingAxosoft Scrum and Bug Tracking Add Work Item csv injection5.1 Medium
- medical informatics engineering enterprise healthMedical Informatics Engineering Enterprise Health CSV injection6.3 Medium
- avigilon access control managerA CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows...9.8 Critical
- denis v (artprima) ap honeypot wordpress pluginWordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- hikvision hikcentral master liteThere is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow...4.7 Medium
- unopimUnoPim Quick Export feature is vulnerable to CSV injection2.5 Low
- eladminelunez eladmin exportUser csv injection5.3 Medium
- No product listedCycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file5.4 Medium
- anwppro anwp football leaguesAnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection4.8 Medium
- xujeff tianti 天梯xujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injection5.3 Medium
- alfasado powercmsMultiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product...4.8 Medium
- No product listedAn issue was discovered in Archer Technology RSA Archer 6.11.00204.10014 allowing attackers to...8.8 High
- apos37 broken link notifierBroken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection4.1 Medium
- intelbras incontrol, incontrol web +1 moreIntelbras InControl operador csv injection5.1 Medium
- ncr terminal handlerA CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute...9.8 Critical
- progetFormula injection in a CSV file in Proget MDM2.4 Low
- 1panel-dev maxkb1Panel-dev MaxKB Knowledge Base Module csv injection5.1 Medium
- apache rangerApache Ranger: Improper Neutralization of Formula Elements in a CSV File9.8 Critical
- No product listedIncorta Edit Insight csv injection5.3 Medium
- phpjabbers meeting room booking systemPHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which...8.8 High
- phpjabbers cinema booking systemPHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows...8.8 High
- phpjabbers bus reservation systemPHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows...8.8 High
- phpjabbers car park booking systemPHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows...8.8 High
- ibm cognos controller, controller +1 moreIBM Cognos Controller CSV injection8.0 High
- phpjabbers hotel booking systemPHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an...8.8 High
- phpjabbers event booking calendarPHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows...4.7 Medium
- kwhotelKWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.9.8 Critical
- kwhotelKWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.9.8 Critical
- fortinet fortisoarAn improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through...8.3 High
- zte zenic one r58ZTE ZENIC ONE R58 product has a CSV injection vulnerability7.6 High
- phpldapadminphpLDAPadmin: Improper Neutralization of Formula Elements5.0 Medium
- samsung magicianAn issue was discovered in the installer in Samsung Magician 8.1.0 on Windows. An attacker can...2.8 Low
- autolabCourse Roster vulnerable to CSV Injection in Autolab6.8 Medium
- Show moreLoading…