CVE-2026-64955 | Medium | 6.1 | 2026-08-12 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.
Velocira… |
CVE-2026-47705 | Critical | 9.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or es… |
CVE-2026-18738 | Medium | 4.7 | 2026-08-03 | Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas in… |
CVE-2026-65875 | High | 7.1 | 2026-08-03 | BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code i… |
CVE-2026-54243 | Medium | 6.1 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.p… |
CVE-2026-14846 | | | 2026-07-13 | In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ par… |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |
CVE-2026-50179 | Medium | 4.2 | 2026-07-07 | Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to… |
CVE-2026-46672 | Medium | 4.6 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever t… |
CVE-2026-47693 | Medium | 6.9 | 2026-06-23 | Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in… |
CVE-2026-5242 | High | 8.8 | 2026-06-15 | Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection.
This issue affects Pizzy L… |
CVE-2025-52612 | High | 7.1 | 2026-06-04 | HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by a… |
CVE-2026-10248 | Medium | 4.7 | 2026-06-01 | A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_supplier of the file /Ex… |
CVE-2026-9673 | Medium | 6.8 | 2026-05-28 | Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An a… |
CVE-2026-41073 | Medium | 4.6 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) i… |
CVE-2026-35157 | Medium | 5.8 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File… |
CVE-2026-42267 | Medium | 5.7 | 2026-05-08 | Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its na… |
CVE-2026-27644 | Medium | 6.5 | 2026-05-05 | Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-control… |
CVE-2023-54348 | High | 8.8 | 2026-05-05 | ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute o… |
CVE-2026-31049 | Critical | 9.8 | 2026-04-14 | An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field |
CVE-2026-39424 | Medium | 4.7 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula E… |
CVE-2026-24447 | Medium | 6.5 | 2026-02-04 | If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user downl… |
CVE-2025-67851 | Medium | 6.1 | 2026-02-03 | A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit… |
CVE-2020-36962 | Critical | 9.8 | 2026-01-28 | Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during expo… |
CVE-2021-47901 | Critical | 9.8 | 2026-01-27 | Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints… |
CVE-2020-36941 | Critical | 9.8 | 2026-01-27 | Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Att… |
CVE-2026-23873 | Critical | 9.0 | 2026-01-22 | hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Inject… |
CVE-2025-61873 | Low | 2.6 | 2026-01-16 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. |
CVE-2025-66834 | High | 7.3 | 2025-12-30 | A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via… |
CVE-2023-53929 | High | 8.8 | 2025-12-17 | phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can mod… |
CVE-2023-53913 | High | 8.8 | 2025-12-17 | Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can c… |
CVE-2023-53905 | High | 8.0 | 2025-12-17 | ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can cr… |
CVE-2025-14229 | Medium | 4.7 | 2025-12-08 | A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC… |
CVE-2025-51735 | High | 7.5 | 2025-11-28 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-13133 | Medium | 6.6 | 2025-11-18 | The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' fun… |
CVE-2025-12249 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Per… |
CVE-2025-11576 | Medium | 4.3 | 2025-10-24 | The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and incl… |
CVE-2025-60852 | Medium | 6.5 | 2025-10-23 | A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework d… |
CVE-2025-62417 | High | 7.8 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepte… |
CVE-2025-11498 | Medium | 6.1 | 2025-10-14 | An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before… |
CVE-2025-11254 | Medium | 4.3 | 2025-10-11 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0… |
CVE-2025-11279 | Medium | 5.5 | 2025-10-05 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. Th… |
CVE-2025-35033 | Medium | 4.1 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadab… |
CVE-2025-56267 | Critical | 9.8 | 2025-09-08 | A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel… |
CVE-2025-58855 | High | 7.1 | 2025-09-05 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.Thi… |
CVE-2025-39245 | Medium | 4.7 | 2025-08-29 | There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV da… |
CVE-2025-55745 | High | 8.8 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection… |
CVE-2025-9241 | Medium | 6.3 | 2025-08-20 | A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be ini… |
CVE-2025-52386 | Medium | 5.4 | 2025-08-13 | CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file |
CVE-2025-8767 | Medium | 4.8 | 2025-08-12 | The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and… |
CVE-2025-8808 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been rated as problematic. This issue affects the function exportOrder of the file /tianti-modu… |
CVE-2025-50572 | High | 8.8 | 2025-07-31 | Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user… |
CVE-2025-54752 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it… |
CVE-2025-6838 | Medium | 4.1 | 2025-07-11 | The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later export… |
CVE-2025-7061 | Low | 2.7 | 2025-07-04 | A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/… |
CVE-2023-47295 | Critical | 9.8 | 2025-06-23 | A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field… |
CVE-2025-1421 | | | 2025-05-21 | Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as… |
CVE-2025-4546 | Medium | 4.7 | 2025-05-11 | A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0.
Users are recommended to upgrade to versio… |
CVE-2025-1836 | Medium | 4.3 | 2025-03-02 | A vulnerability was found in Incorta 2023.4.3. It has been classified as problematic. Affected is an unknown function of the component Edit Insight Handler. Th… |
CVE-2023-51336 | High | 8.8 | 2025-02-20 | PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51333 | High | 8.8 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists du… |
CVE-2023-51319 | High | 8.8 | 2025-02-20 | PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51311 | High | 8.8 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists… |
CVE-2023-51302 | High | 8.8 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due… |
CVE-2023-51298 | Medium | 4.7 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2024-45084 | High | 8.0 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
could allow an authenticated attacker to conduct formula injection. An attacker cou… |
CVE-2023-46401 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. |
CVE-2023-46400 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. |
CVE-2024-47572 | Critical | 9.0 | 2025-01-14 | An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands… |
CVE-2024-22063 | High | 7.6 | 2024-12-30 | The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with m… |
CVE-2024-9102 | | | 2024-12-19 | phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Val… |
CVE-2024-53921 | Low | 2.8 | 2024-12-03 | An issue was discovered in the installer in Samsung Magician 8.1.0 on Windows. An attacker can create arbitrary folders in the system permission directory via… |
CVE-2024-53260 | Medium | 6.8 | 2024-11-27 | Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid exce… |
CVE-2024-53555 | High | 8.8 | 2024-11-26 | A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. |
CVE-2024-51094 | High | 8.0 | 2024-11-12 | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. W… |
CVE-2024-47485 | Critical | 9.8 | 2024-10-18 | There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable com… |
CVE-2021-38963 | High | 8.0 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerabi… |
CVE-2024-27321 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification t… |
CVE-2024-27320 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle… |
CVE-2024-41226 | High | 7.8 | 2024-08-06 | A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Autom… |
CVE-2024-3232 | High | 7.6 | 2024-07-16 | A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate ap… |
CVE-2024-27785 | Medium | 5.4 | 2024-07-09 | An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to… |
CVE-2023-5527 | High | 7.4 | 2024-06-18 | The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file… |
CVE-2023-5424 | Medium | 4.7 | 2024-06-07 | The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed… |
CVE-2024-28764 | Medium | 6.5 | 2024-05-01 | IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary c… |
CVE-2023-48709 | High | 8.0 | 2024-04-15 | iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas t… |
CVE-2024-3214 | Medium | 5.8 | 2024-04-09 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for u… |
CVE-2024-25007 | High | 7.1 | 2024-04-04 |
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Fo… |
CVE-2024-29375 | Critical | 9.8 | 2024-04-04 | CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to the Project Descript… |
CVE-2023-35899 | High | 7.0 | 2024-03-21 | IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially… |
CVE-2023-47534 | Critical | 9.6 | 2024-03-12 | A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9… |
CVE-2024-28111 | Medium | 6.5 | 2024-03-06 | Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The gen… |
CVE-2023-45597 | Medium | 5.9 | 2024-03-05 | A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerni… |
CVE-2024-24337 | High | 8.0 | 2024-02-12 | CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allo… |
CVE-2023-47022 | Medium | 6.5 | 2024-02-06 | Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection. |
CVE-2022-3604 | High | 7.8 | 2024-01-16 | The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. |
CVE-2023-31295 | High | 7.5 | 2023-12-29 | CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information v… |
CVE-2023-31296 | Medium | 5.3 | 2023-12-29 | CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the… |
CVE-2023-31294 | High | 7.5 | 2023-12-29 | CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information v… |