Total
251 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-41791 | 1 Metagauss | 1 Profilegrid | 2025-02-20 | N/A | 6.5 MEDIUM |
| Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. | |||||
| CVE-2022-38061 | 1 Apasionados | 1 Export Post Info | 2025-02-20 | N/A | 6.2 MEDIUM |
| Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress. | |||||
| CVE-2023-41798 | 1 Wpwax | 1 Directorist | 2025-02-19 | N/A | 8.8 HIGH |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1. | |||||
| CVE-2022-45810 | 1 Icegram | 1 Icegram Express | 2025-02-19 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2. | |||||
| CVE-2022-45370 | 1 Webtoffee | 1 Wordpress Comments Import And Export | 2025-02-19 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1. | |||||
| CVE-2023-25983 | 1 Logon | 1 Kb Support | 2025-02-11 | N/A | 8.8 HIGH |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84. | |||||
| CVE-2023-46400 | 1 Kwhotel | 1 Kwhotel | 2025-02-07 | N/A | 9.8 CRITICAL |
| KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. | |||||
| CVE-2019-16120 | 1 Liquidweb | 1 Event Tickets | 2025-02-07 | 6.5 MEDIUM | 8.8 HIGH |
| CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. | |||||
| CVE-2023-48709 | 1 Combodo | 1 Itop | 2025-02-06 | N/A | 8.0 HIGH |
| iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0. | |||||
| CVE-2023-46401 | 1 Kwhotel | 1 Kwhotel | 2025-02-04 | N/A | 9.8 CRITICAL |
| KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. | |||||
| CVE-2023-25348 | 1 Churchcrm | 1 Churchcrm | 2025-02-04 | N/A | 7.8 HIGH |
| ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. | |||||
| CVE-2023-29918 | 1 Rosariosis | 1 Rosariosis | 2025-01-30 | N/A | 5.4 MEDIUM |
| RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. | |||||
| CVE-2024-3214 | 1 Relevanssi | 1 Relevanssi | 2025-01-28 | N/A | 5.8 MEDIUM |
| The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. | |||||
| CVE-2024-22063 | 1 Zte | 1 Zenic One R58 | 2025-01-28 | N/A | 7.6 HIGH |
| The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices. | |||||
| CVE-2023-33410 | 1 Minical | 1 Minical | 2025-01-08 | N/A | 8.8 HIGH |
| Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file. | |||||
| CVE-2024-53555 | 2024-11-26 | N/A | 8.8 HIGH | ||
| A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. | |||||
| CVE-2024-28111 | 2024-11-21 | N/A | 6.5 MEDIUM | ||
| Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue. | |||||
| CVE-2024-27785 | 1 Fortinet | 1 Fortiaiops | 2024-11-21 | N/A | 5.4 MEDIUM |
| An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiAIOps version 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports. | |||||
| CVE-2024-25007 | 1 Ericsson | 1 Network Manager | 2024-11-21 | N/A | 7.1 HIGH |
| Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability. | |||||
| CVE-2023-5527 | 1 Businessdirectoryplugin | 1 Business Directory | 2024-11-21 | N/A | 7.4 HIGH |
| The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. | |||||