Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 330

Export CSV
CVE-2026-47693

Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Poweradmin
Products
Poweradmin
CVE-2026-5242

Code Injection in Mia Technologies' Pizzy Library

Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mia Technology
Products
Pizzy Library
CVE-2023-4006

Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq

Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2025-52612

HCL iControl was affected by Export CSV - CSV Injection vulnerability.

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Icontrol
CVE-2026-10248

SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection

A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_supplier of the file /Export_csv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Pharmacy Sales And Inventory System
CVE-2023-54348

ERPGo SaaS 3.9 CSV Injection via Vendor Creation

ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation of users who open the exported CSV in a spreadsheet application. Attackers can add malicious formulas like =10+20+cmd|' /C calc'!A0 in the vendor creation form, which execute when the exported CSV file is opened in spreadsheet applications.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rajodiya
Products
Erpgo Saas
CVE-2026-41073

RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Bestpractical
Products
Rt
CVE-2026-42267

Kimai: Formula Injection via tag names in XLSX export

Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue() joins tag names with implode() and returns the result unchanged. OpenSpout promotes any =-prefixed string to a FormulaCell, writing <f>SUM(54+51)</f> into the XLSX archive. Excel evaluates the formula when the file is opened. This issue has been patched in version 2.54.0.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Kimai
Products
Kimai
CVE-2026-35157

Improper Neutralization of Formula Elements in CSV File Allowing Remote Execution

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Ecs Elastic Cloud Storage Objectscale
CVE-2026-27644

traccar allows CSV formula injection via exported position data

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Traccar
Products
Traccar
CVE-2023-25983

WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Kbsupport Logon
Products
Kb Support Kb Support
CVE-2023-41798

WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wpwax
Products
Directorist
CVE-2023-36527

WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft
Products
Post To Csv
CVE-2023-23796

WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Web-settler
Products
Form Builder
CVE-2023-23678

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpeka
Products
Wp Cookie Consent
CVE-2023-22719

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Givewp
Products
Givewp
CVE-2022-47442

WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Userswp
CVE-2022-46821

WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jackmail
Products
Jackmail
CVE-2022-46809

WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdeveloper
Products
Reviewx
CVE-2022-46804

WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Narolainfotech
Products
Export Users Data Distinct