Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 445

Export CSV
CVE-2022-45357

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Lenderd
Products
1003 Mortgage Application
CVE-2022-45350

WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Simple-history
Products
Simple History
CVE-2022-45348

WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Anmari
Products
Amr Users
CVE-2022-44738

WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Patrickrobrecht
Products
Posts And Users Stats
CVE-2022-42882

WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Shambix
Products
Simple Csv\/xls Exporter
CVE-2022-41616

WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed
Vendors
Kaushikkalathiya
Products
Export Users Data
CVE-2022-38702

WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Kigurumi
Products
Csv Exporter
CVE-2022-45078

WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Solwininfotech
Products
User Blocker
CVE-2022-41791

WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2025-69809

Unauthenticated Write‑What‑Where in p2r3 Bareiron Enables Arbitrary Code Execution

A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted packet.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
P2r3
Products
Bareiron
CVE-2024-42479

llama.cpp allows write-what-where in rpc_server::set_tensor

llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561.

CVSS 3.1 · 10 Critical EPSS 2.6% KEV · Not listed
Vendors
Ggerganov Ggml
Products
Llama.cpp Llama.cpp
CVE-2025-58855

WordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8767

AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection

The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and 'download_csv_games' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Anwp Wordpress
Products
Football Leagues Wordpress
CVE-2025-11254

Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contest-gallery Wordpress
Products
Contest Gallery Wordpress
CVE-2025-11576

AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection

The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5. This is due to insufficient sanitization in the 'newcodebyte_chatbot_export_messages' function. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Newcodebyte Wordpress
Products
Ai Chatbot Free Models Wordpress
CVE-2025-13133

Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-6838

Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2026-39424

MaxKB has CSV Injection in its Application Chat Export Functionality

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file (.xlsx) via the /admin/api/workspace/{workspace_id}/application/{application_id}/chat/export endpoint, strings starting with formula characters are written directly without proper sanitization. Opening this file in spreadsheet applications like Microsoft Excel can lead to Arbitrary Code Execution (RCE) on the administrator's workstation via Dynamic Data Exchange (DDE). The issue is a variant of CVE-2025-4546, which fixed the exact same pattern in apps/dataset/serializers/document_serializers.py but missed the application chat export sink. This issue has been fixed in version 2.8.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
1panel Maxkb
Products
Maxkb Maxkb
CVE-2026-24447

CSV Export Malformed Data Leading to Embedded Code Execution

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Six Apart Six Apart Ltd
Products
Movable Type Movable Type
CVE-2026-23873

HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hustoj
Products
Hustoj