Total
222 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-28845 | 1 Netskope | 1 Netskope | 2024-08-04 | 7.8 High |
| A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. | ||||
| CVE-2020-28861 | 1 Openasset | 1 Digital Asset Management | 2024-08-04 | 5.3 Medium |
| OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application. | ||||
| CVE-2020-26507 | 1 Marmind | 1 Marmind | 2024-08-04 | 7.8 High |
| A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into the “Description” field under the “Insert To-Do” option. Other users might download this data, for example a CSV file, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel. The attacker could gain remote access to the user’s PC. | ||||
| CVE-2020-25398 | 1 Mind | 1 Imind Server | 2024-08-04 | 8.8 High |
| CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. | ||||
| CVE-2020-25445 | 1 Bookingcore | 1 Booking Core | 2024-08-04 | 7.8 High |
| The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed. | ||||
| CVE-2020-24707 | 1 Getgophish | 1 Gophish | 2024-08-04 | 7.8 High |
| Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. | ||||
| CVE-2020-22278 | 1 Phpmyadmin | 1 Phpmyadmin | 2024-08-04 | 8.8 High |
| phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents. | ||||
| CVE-2020-22276 | 1 Weformspro | 1 Weforms | 2024-08-04 | 9.8 Critical |
| WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. | ||||
| CVE-2020-22275 | 1 Easyregistrationforms | 1 Easy Registration Forms | 2024-08-04 | 8.8 High |
| Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable. | ||||
| CVE-2020-22390 | 1 Akaunting | 1 Akaunting | 2024-08-04 | 8.8 High |
| Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened. | ||||
| CVE-2020-22277 | 1 Codection | 1 Import And Export Users And Customers | 2024-08-04 | 8.0 High |
| Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. | ||||
| CVE-2020-22274 | 1 Jomsocial | 1 Jomsocial | 2024-08-04 | 9.8 Critical |
| JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile. | ||||
| CVE-2020-16214 | 1 Philips | 1 Patient Information Center Ix | 2024-08-04 | 5.0 Medium |
| In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. | ||||
| CVE-2020-15301 | 1 Salesagility | 1 Suitecrm | 2024-08-04 | 7.8 High |
| SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation. | ||||
| CVE-2020-15255 | 1 Anuko | 1 Time Tracker | 2024-08-04 | 8.7 High |
| In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325. | ||||
| CVE-2020-14026 | 1 Ozeki | 1 Ozeki Ng Sms Gateway | 2024-08-04 | 8.8 High |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export. | ||||
| CVE-2020-13826 | 1 I-doit | 1 I-doit | 2024-08-04 | 8.8 High |
| A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export. | ||||
| CVE-2020-13247 | 1 Boolebox | 1 Boolebox | 2024-08-04 | 7.3 High |
| BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area. | ||||
| CVE-2020-13146 | 1 Edx | 1 Open Edx Platform | 2024-08-04 | 8.8 High |
| Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature. | ||||
| CVE-2020-11548 | 1 Search Meter Project | 1 Search Meter | 2024-08-04 | 9.8 Critical |
| The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed. | ||||