Total
216 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-14026 | 1 Ozeki | 1 Ozeki Ng Sms Gateway | 2020-09-26 | 9.3 HIGH | 8.8 HIGH |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export. | |||||
| CVE-2018-10504 | 1 Web-dorado | 1 Form Maker | 2020-08-24 | 6.8 MEDIUM | 7.8 HIGH |
| The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. | |||||
| CVE-2018-10257 | 1 Hrsale Project | 1 Hrsale | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. | |||||
| CVE-2019-14749 | 1 Osticket | 1 Osticket | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected. | |||||
| CVE-2018-11525 | 1 Algolplus | 1 Advanced Order Export | 2020-08-24 | 6.8 MEDIUM | 7.8 HIGH |
| The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. | |||||
| CVE-2019-12134 | 1 Workday | 1 Workday | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export. | |||||
| CVE-2018-20468 | 1 Sahipro | 1 Sahi Pro | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution. | |||||
| CVE-2018-8092 | 1 Mautic | 1 Mautic | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Mautic before 2.13.0 allows CSV injection. | |||||
| CVE-2019-12961 | 1 Livezilla | 1 Livezilla | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function. | |||||
| CVE-2018-16651 | 1 Phpmyfaq | 1 Phpmyfaq | 2020-08-24 | 9.0 HIGH | 7.2 HIGH |
| The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. | |||||
| CVE-2018-9035 | 1 Contact-form-7-to-database-extension Project | 1 Contact-form-7-to-database-extension | 2020-08-24 | 6.8 MEDIUM | 9.6 CRITICAL |
| CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form. | |||||
| CVE-2018-9106 | 1 Acyba | 1 Acysms | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export. | |||||
| CVE-2018-15571 | 1 Export Users To Csv Project | 1 Export Users To Csv | 2020-08-24 | 6.8 MEDIUM | 8.6 HIGH |
| The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. | |||||
| CVE-2019-15092 | 1 Webtoffee | 1 Import Export Wordpress Users | 2020-08-24 | 6.0 MEDIUM | 7.3 HIGH |
| The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class. | |||||
| CVE-2018-7304 | 1 Tiki | 1 Tiki | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation. | |||||
| CVE-2018-7201 | 1 Projectsend | 1 Projectsend | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. | |||||
| CVE-2018-16308 | 1 Ninjaforms | 1 Ninja Forms | 2020-08-24 | 6.8 MEDIUM | 8.6 HIGH |
| The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. | |||||
| CVE-2019-0403 | 1 Sap | 1 Enable Now | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection. | |||||
| CVE-2018-16275 | 1 Opswat | 1 Metadefender | 2020-08-24 | 6.8 MEDIUM | 7.8 HIGH |
| OPSWAT MetaDefender before v4.11.2 allows CSV injection. | |||||
| CVE-2019-6187 | 1 Lenovo | 42 Thinksystem Sr670, Thinkagile 7d1h, Thinkagile 7x82 and 39 more | 2020-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server. | |||||