Skip to content
Noroxi

CWE-1236 · 310 records

Improper Neutralization of Formula Elements in a CSV File

CVEs in this class

310 records

  • CVE-2021-33256
    59Plan

    A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unaut

    HighCVSS 8.8No exploitEPSS 79%

    zohocorp · manageengine adselfservice plusAug 9, 2021

  • CVE-2018-11652
    46Plan

    CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HT

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    cirt.net · niktoJun 1, 2018

  • CVE-2019-12765
    42Plan

    An issue was discovered in Joomla! before 3.9.7.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    joomla · joomla\!Jun 11, 2019

  • CVE-2020-9347
    41Plan

    Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by t

    CriticalCVSS 9.8No exploitEPSS 7%

    zohocorp · manageengine password manager proMar 16, 2020

  • CVE-2020-11548
    41Plan

    The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.

    CriticalCVSS 9.8No exploitEPSS 5%

    search meter project · search meterApr 4, 2020

  • CVE-2018-9035
    40Plan

    CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote at

    CriticalCVSS 9.6Proof of conceptEPSS 7%

    contact-form-7-to-database-extension project · contact-form-7-to-database-extensionApr 4, 2018

  • CVE-2022-3634
    40Plan

    Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

    CriticalCVSS 9.8No exploitEPSS 3%

    ciphercoin · contact form 7 database addonNov 21, 2022

  • CVE-2018-20752
    40Plan

    An issue was discovered in Recon-ng before 4.9.5.

    CriticalCVSS 9.8No exploitEPSS 3%

    recon-ng project · recon-ngFeb 4, 2019

  • CVE-2020-22276
    40Plan

    WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.

    CriticalCVSS 9.8No exploitEPSS 3%

    weformspro · weformsNov 4, 2020

  • CVE-2022-0142
    40Plan

    Visual Form Builder < 3.0.6 - CSV Injection

    CriticalCVSS 9.8No exploitEPSS 2%

    vfbpro · visual form builderApr 12, 2022

  • CVE-2020-7947
    40Plan

    An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.

    CriticalCVSS 9.8No exploitEPSS 2%

    auth0 · login by auth0Apr 1, 2020

  • CVE-2019-4521
    40Plan

    Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection.

    CriticalCVSS 9.8No exploitEPSS 2%

    ibm · cloud pak systemDec 10, 2019

  • CVE-2019-0403
    40Plan

    SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to

    CriticalCVSS 9.8No exploitEPSS 2%

    sap · enable nowDec 11, 2019

  • CVE-2021-38180
    40Plan

    SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitati

    CriticalCVSS 9.8No exploitEPSS 2%

    sap · business oneOct 12, 2021

  • CVE-2022-3393
    40Plan

    Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    bestwebsoft · post to csvOct 25, 2022

  • CVE-2022-26249
    40Plan

    Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitiv

    CriticalCVSS 9.8No exploitEPSS 1%

    surveyking project · surveykingMar 24, 2022

  • CVE-2019-13144
    40Plan

    myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    mytinytodo · mytinytodoJul 5, 2019

  • CVE-2021-3188
    40Plan

    phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

    CriticalCVSS 9.8No exploitEPSS 1%

    phplist · phplistJan 26, 2021

  • CVE-2022-28481
    40Plan

    CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

    CriticalCVSS 9.8No exploitEPSS 1%

    csv-safe project · csv-safeMay 1, 2022

  • CVE-2019-16184
    40Plan

    A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey res

    CriticalCVSS 9.8No exploitEPSS 1%

    limesurvey · limesurveySep 9, 2019

  • CVE-2018-15474
    39Monitor

    CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier all

    CriticalCVSS 9.6No exploitEPSS 3%

    dokuwiki · dokuwikiSep 7, 2018

  • CVE-2018-8092
    39Monitor

    Mautic before 2.13.0 allows CSV injection.

    CriticalCVSS 9.8No exploitEPSS 1%

    mautic · mauticApr 18, 2018

  • CVE-2020-22274
    39Monitor

    JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.

    CriticalCVSS 9.8No exploitEPSS 1%

    jomsocial · jomsocialNov 4, 2020

  • CVE-2022-3463
    39Monitor

    FluentForm < 4.3.13 - CSV Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    fluentforms · contact formNov 7, 2022

  • CVE-2020-10131
    39Monitor

    SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    searchblox · searchbloxSep 6, 2023

All vulnerability classes