CWE-1236 Archives - CVE Vulnerability

CVE-2018-9137

Sun, 26 Feb 2023 06:51:45 +0000

Open-AudIT before 2.2 has CSV Injection.

The post CVE-2018-9137 appeared first on CVE Vulnerability.

CVE-2018-9106

Sun, 26 Feb 2023 06:51:44 +0000

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.

The post CVE-2018-9106 appeared first on CVE Vulnerability.

CVE-2018-9107

Sun, 26 Feb 2023 06:51:44 +0000

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.

The post CVE-2018-9107 appeared first on CVE Vulnerability.

CVE-2018-9035

Sun, 26 Feb 2023 06:51:42 +0000

CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.

The post CVE-2018-9035 appeared first on CVE Vulnerability.

CVE-2018-8092

Sun, 26 Feb 2023 06:51:17 +0000

Mautic before 2.13.0 allows CSV injection.

The post CVE-2018-8092 appeared first on CVE Vulnerability.

CVE-2018-7304

Sun, 26 Feb 2023 06:51:01 +0000

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an “=cmd|’ /C calc’!A0” payload during User Creation.

The post CVE-2018-7304 appeared first on CVE Vulnerability.

CVE-2018-7201

Sun, 26 Feb 2023 06:50:58 +0000

CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.

The post CVE-2018-7201 appeared first on CVE Vulnerability.

CVE-2018-20752

Sun, 26 Feb 2023 06:48:42 +0000

An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.

The post CVE-2018-20752 appeared first on CVE Vulnerability.

CVE-2018-20468

Sun, 26 Feb 2023 06:48:35 +0000

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has “export to excel features” that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution.

The post CVE-2018-20468 appeared first on CVE Vulnerability.

CVE-2018-19855

Sun, 26 Feb 2023 06:48:20 +0000

UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.

The post CVE-2018-19855 appeared first on CVE Vulnerability.