CVE-2018-25135

9.3 criticalEPSS 0.7%

Critical (9.3). EPSS 0.7% chance of exploitation in the next 30 days.

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-149
Published: 2025-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.anviz.com
https://www.exploit-db.com/exploits/45765
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php
https://www.exploit-db.com/exploits/45765
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php

Check your stack JSON