CWE-1236 · Improper Neutralization of Formula Elements in a CSV File (page 2)
Page 2 of 4 — CVEs classified under CWE-1236, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50448 | Medium | 6.5 | 2023-12-28 | In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user)… |
CVE-2023-51763 | Critical | 9.8 | 2023-12-24 | csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection. |
CVE-2023-48207 | High | 8.8 | 2023-12-07 | Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. |
CVE-2023-42004 | High | 8.0 | 2023-11-28 | IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper vali… |
CVE-2023-48029 | High | 8.0 | 2023-11-17 | Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploi… |
CVE-2023-41798 | Medium | 5.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing… |
CVE-2022-44738 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: fro… |
CVE-2022-42882 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a… |
CVE-2022-41616 | High | 7.6 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: fr… |
CVE-2022-38702 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a thro… |
CVE-2022-46821 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails &… |
CVE-2022-46809 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue aff… |
CVE-2022-46804 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export U… |
CVE-2022-46803 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsle… |
CVE-2022-46801 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0. |
CVE-2022-45810 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress… |
CVE-2022-45370 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments I… |
CVE-2022-45360 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through… |
CVE-2022-45348 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4. |
CVE-2022-45078 | Medium | 5.9 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5. |
CVE-2023-36527 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft… |
CVE-2023-25983 | High | 8.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84. |
CVE-2023-23796 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builde… |
CVE-2023-23678 | Medium | 4.0 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cook… |
CVE-2023-22719 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2022-46802 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product R… |
CVE-2022-45357 | Medium | 6.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from… |
CVE-2022-47442 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9. |
CVE-2022-45350 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Sim… |
CVE-2023-43071 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cro… |
CVE-2020-10131 | Critical | 9.8 | 2023-09-06 | SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter. |
CVE-2023-22877 | High | 7.0 | 2023-08-28 | IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2023-38843 | High | 8.0 | 2023-08-17 | An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function. |
CVE-2023-4006 | Critical | 9.8 | 2023-07-31 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-37219 | High | 7.3 | 2023-07-30 | Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File |
CVE-2022-28864 | High | 8.8 | 2023-07-24 | An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parame… |
CVE-2023-3527 | Medium | 6.8 | 2023-07-18 | A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges… |
CVE-2023-28958 | High | 7.0 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the sy… |
CVE-2023-3493 | High | 8.0 | 2023-06-30 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3. |
CVE-2022-46408 | Medium | 6.8 | 2023-06-29 | Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutraliz… |
CVE-2023-3302 | High | 7.8 | 2023-06-23 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-31867 | High | 7.2 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. |
CVE-2023-0721 | High | 8.3 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthentic… |
CVE-2023-33410 | High | 8.8 | 2023-06-05 | Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient… |
CVE-2023-2629 | High | 7.8 | 2023-05-10 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9. |
CVE-2023-29918 | Medium | 5.4 | 2023-05-02 | RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. |
CVE-2023-25348 | High | 7.8 | 2023-04-25 | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnera… |
CVE-2023-2258 | High | 8.8 | 2023-04-24 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. |
CVE-2023-29109 | Medium | 4.4 | 2023-04-11 | The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application al… |
CVE-2023-25611 | Medium | 4.0 | 2023-03-07 | A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows loca… |
CVE-2022-35281 | Medium | 5.5 | 2023-01-09 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV inje… |
CVE-2022-37786 | Medium | 6.3 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Para… |
CVE-2022-37905 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-4034 | Medium | 5.8 | 2022-11-29 | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthent… |
CVE-2022-41675 | High | 8.0 | 2022-11-29 | A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form conten… |
CVE-2022-44830 | High | 7.8 | 2022-11-21 | Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. The… |
CVE-2022-41791 | Medium | 6.8 | 2022-11-17 | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. |
CVE-2022-3574 | Critical | 9.8 | 2022-11-14 | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. |
CVE-2022-27858 | High | 7.4 | 2022-11-08 | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. |
CVE-2022-3558 | High | 8.0 | 2022-11-07 | The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. |
CVE-2022-3463 | Critical | 9.8 | 2022-11-07 | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection |
CVE-2022-22425 | Critical | 9.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2022-40294 | High | 8.8 | 2022-10-31 | The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then t… |
CVE-2022-3393 | Critical | 9.8 | 2022-10-25 | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection |
CVE-2022-40472 | High | 8.0 | 2022-09-29 | ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows… |
CVE-2022-38061 | Medium | 6.2 | 2022-09-23 | Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress. |
CVE-2022-38844 | High | 8.0 | 2022-09-16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of execu… |
CVE-2022-2798 | High | 8.0 | 2022-09-16 | The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to pe… |
CVE-2022-1194 | High | 8.8 | 2022-09-16 | The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exp… |
CVE-2022-3026 | Medium | 6.5 | 2022-09-06 | The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This ma… |
CVE-2022-2429 | Medium | 6.5 | 2022-09-06 | The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Util… |
CVE-2022-2240 | High | 8.8 | 2022-07-25 | The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quo… |
CVE-2022-1539 | High | 8.8 | 2022-07-25 | The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injectio… |
CVE-2022-2112 | High | 8.8 | 2022-06-17 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-1202 | High | 7.8 | 2022-06-13 | The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability. |
CVE-2022-2027 | High | 8.0 | 2022-06-09 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2020-36531 | Medium | 6.3 | 2022-06-07 | A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Pag… |
CVE-2022-26867 | Medium | 5.9 | 2022-06-02 | PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It… |
CVE-2022-28481 | Critical | 9.8 | 2022-05-01 | CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection. |
CVE-2022-1544 | High | 7.8 | 2022-05-01 | Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Success… |
CVE-2022-29315 | High | 8.8 | 2022-04-19 | Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used. |
CVE-2021-23286 | Medium | 5.7 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This i… |
CVE-2021-43257 | High | 7.8 | 2022-04-14 | Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to informati… |
CVE-2022-0142 | Critical | 9.8 | 2022-04-12 | The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that w… |
CVE-2021-43515 | High | 7.8 | 2022-04-08 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious paylo… |
CVE-2022-23868 | High | 7.8 | 2022-03-30 | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. |
CVE-2022-26249 | Critical | 9.8 | 2022-03-24 | Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a… |
CVE-2022-24770 | High | 8.8 | 2022-03-17 | `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutra… |
CVE-2021-39022 | High | 8.8 | 2022-03-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or i… |
CVE-2021-46363 | High | 7.8 | 2022-02-11 | An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas ma… |
CVE-2022-22689 | High | 8.8 | 2022-02-04 | CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient in… |
CVE-2022-22121 | High | 8.0 | 2022-01-10 | In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to… |
CVE-2021-23654 | Medium | 5.6 | 2021-11-26 | This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would b… |
CVE-2021-41270 | Medium | 6.5 | 2021-11-24 | Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PH… |
CVE-2021-36334 | Medium | 5.9 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu… |
CVE-2021-38424 | Medium | 5.9 | 2021-11-03 | The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may… |
CVE-2021-40848 | High | 7.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, l… |
CVE-2020-36503 | High | 8.0 | 2021-11-01 | The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue |
CVE-2021-37131 | Medium | 6.8 | 2021-10-27 | There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability t… |
CVE-2021-38180 | Critical | 9.8 | 2021-10-12 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data… |