Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (340 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-0174 1 Intel 376 2000e, 2000e Firmware, 2002e and 373 more 2024-11-21 N/A
Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.
CVE-2018-9137 1 Open-audit 1 Open-audit 2024-11-21 N/A
Open-AudIT before 2.2 has CSV Injection.
CVE-2018-9107 1 Acyba 1 Acymailing 2024-11-21 N/A
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.
CVE-2018-9106 1 Acyba 1 Acysms 2024-11-21 N/A
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.
CVE-2018-9035 1 Contact-form-7-to-database-extension Project 1 Contact-form-7-to-database-extension 2024-11-21 N/A
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.
CVE-2018-8092 1 Mautic 1 Mautic 2024-11-21 N/A
Mautic before 2.13.0 allows CSV injection.
CVE-2018-7304 1 Tiki 1 Tiki 2024-11-21 N/A
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.
CVE-2018-7201 1 Projectsend 1 Projectsend 2024-11-21 N/A
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVE-2018-3971 1 Sophos 1 Hitmanpro.alert 2024-11-21 7.8 High
An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.
CVE-2018-3640 2 Arm, Intel 199 Cortex-a, Atom C, Atom E and 196 more 2024-11-21 N/A
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.
CVE-2018-20752 1 Recon-ng Project 1 Recon-ng 2024-11-21 N/A
An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.
CVE-2018-20468 1 Sahipro 1 Sahi Pro 2024-11-21 N/A
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution.
CVE-2018-1774 1 Ibm 1 Api Connect 2024-11-21 N/A
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.
CVE-2018-19855 1 Uipath 1 Orchestrator 2024-11-21 N/A
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
CVE-2018-16962 2 Apple, Webroot 2 Macos, Secureanywhere 2024-11-21 N/A
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
CVE-2018-16651 1 Phpmyfaq 1 Phpmyfaq 2024-11-21 N/A
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
CVE-2018-16308 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVE-2018-16275 1 Opswat 1 Metadefender 2024-11-21 N/A
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
CVE-2018-15571 1 Export Users To Csv Project 1 Export Users To Csv 2024-11-21 N/A
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
CVE-2018-15474 1 Dokuwiki 1 Dokuwiki 2024-11-21 N/A
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.