cve.bz

CWE-1236: Improper Neutralization of Formula Elements in a CSV File, page 4

Filter

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

What the weakness is: CWE-1236 at MITRE

Ask an AI about CWE-1236

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1236: Improper Neutralization of Formula Elements in a CSV File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1236.html and https://cve.bz/cve/cwe/1236?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-45357EPSS 0.8%

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.

  2. 8.8CVE-2022-47442EPSS 0.7%

    Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

  3. 8.8CVE-2022-45350EPSS 0.8%

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.

  4. 5.4CVE-2023-43071EPSS 0.4%

    Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attack…

  5. 9.8CVE-2020-10131EPSS 1.6%

    SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.

  6. 8.8CVE-2023-22877EPSS 0.7%

    IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.

  7. 8.0CVE-2023-38843EPSS 0.7%

    An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function.

  8. 9.8CVE-2023-4006EPSS 0.8%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.

  9. 7.8CVE-2023-37219EPSS 0.2%

    Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File

  10. 8.8CVE-2022-28864EPSS 1.0%

    An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .x…

  11. 6.8CVE-2023-3527EPSS 0.6%

    A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary…

  12. 7.8CVE-2023-28958EPSS 0.5%

    IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 2517…

  13. 8.0CVE-2023-3493EPSS 0.5%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.

  14. 6.8CVE-2022-46408EPSS 0.9%

    Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or dat…

  15. 7.8CVE-2023-3302EPSS 0.5%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.

  16. 7.2CVE-2023-31867EPSS 0.8%

    Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.

  17. 7.8CVE-2023-0721EPSS 0.7%

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can resul…

  18. 8.8CVE-2023-33410EPSS 1.2%

    Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is use…

  19. 7.8CVE-2023-2629EPSS 0.4%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

  20. 5.4CVE-2023-29918ExploitEPSS 2.2%

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

  21. 7.8CVE-2023-25348EPSS 0.4%

    ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.

  22. 8.8CVE-2023-2258EPSS 0.9%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

  23. 4.6CVE-2023-29109EPSS 0.3%

    The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Exc…

  24. 7.3CVE-2023-25611EPSS 0.3%

    A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet fo…

  25. 8.8CVE-2022-35281EPSS 0.5%

    IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.

  26. 6.3CVE-2022-37786EPSS 0.6%

    An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Params] page, and the [Home / Design / Basekey Configuration] page.

  27. 8.8CVE-2022-37905EPSS 1.0%

    Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underl…

  28. 7.8CVE-2022-4034EPSS 0.7%

    The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation t…

  29. 8.0CVE-2022-41675EPSS 1.0%

    A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to per…

  30. 7.8CVE-2022-44830EPSS 0.6%

    Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel…

  31. 8.8CVE-2022-41791EPSS 0.7%

    Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

  32. 9.8CVE-2022-3574EPSS 1.4%

    The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

  33. 9.8CVE-2022-27858EPSS 0.9%

    CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.

  34. 8.0CVE-2022-3558EPSS 1.3%

    The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.

  35. 9.8CVE-2022-3463EPSS 1.6%

    The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection

  36. 9.8CVE-2022-22425EPSS 1.3%

    "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 223598."

  37. 8.8CVE-2022-40294EPSS 0.9%

    The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.

  38. 9.8CVE-2022-3393EPSS 1.9%

    The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection

  39. 8.0CVE-2022-40472EPSS 1.1%

    ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Cont…

  40. 5.7CVE-2022-38061EPSS 0.8%

    Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.

  41. 8.0CVE-2022-38844EPSS 1.4%

    CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up execu…

  42. 8.0CVE-2022-2798EPSS 1.2%

    The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data

  43. 8.8CVE-2022-1194EPSS 1.3%

    The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.

  44. 8.8CVE-2022-3026EPSS 1.5%

    The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrus…

  45. 8.0CVE-2022-2429EPSS 0.9%

    The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as …

  46. 8.8CVE-2022-2240EPSS 1.4%

    The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

  47. 8.8CVE-2022-1539EPSS 1.5%

    The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously i…

  48. 8.8CVE-2022-2112EPSS 1.3%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

  49. 7.8CVE-2022-1202EPSS 1.0%

    The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.

  50. 8.0CVE-2022-2027EPSS 1.2%

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.