CWE-1236
Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
292 vulnerabilities with CWE-1236
CVE-2026-5242
HIGH
Code Injection in Mia Technologies' Pizzy Library
CVSS 8.8
CVE-2026-10248
MEDIUM
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
CVSS 4.7
CVE-2026-9673
MEDIUM
json-2-csv < 5.5.11 - Improper Neutralization of Formula Elements in a CSV File
CVSS 6.8
CVE-2026-41073
MEDIUM
RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps
CVSS 4.6
CVE-2026-35157
MEDIUM
Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale < 4.3.0.0 - Unauthenticated Remote Code Execution via CSV Formula Injection
CVSS 5.8
CVE-2026-42267
MEDIUM
Kimai: Formula Injection via tag names in XLSX export
CVSS 5.7
CVE-2026-27644
MEDIUM
traccar allows CSV formula injection via exported position data
CVSS 6.5
CVE-2026-31049
CRITICAL
Hostbill 2025-11-24/2025-12-01 - Privilege Escalation
CVSS 9.8
CVE-2026-39424
MEDIUM
MaxKB has CSV Injection in its Application Chat Export Functionality
CVSS 4.7
CVE-2026-24447
MEDIUM
Movable Type 8.0.2-8.0.8, 8.8.0-8.8.1, 9.0.4-9.0.5 - CSV Injection
CVSS 6.5
CVE-2026-23873
CRITICAL
hustoj < 26.01.31 - CSV Injection via Contest Rank Export Nickname Field
CVSS 9.0
CVE-2025-52612
HIGH
HCL iControl was affected by Export CSV - CSV Injection vulnerability.
CVSS 7.1
CVE-2025-67851
MEDIUM
moodle < 4.1.22 - Formula Injection via CSV Export
CVSS 6.1
CVE-2025-61873
LOW
Best Practical RT <4.4.9-6.0.2 - Code Injection
CVSS 2.6
CVE-2025-66834
HIGH
TrueConf Server <5.5.2.10813 - Formula Injection
CVSS 7.3
CVE-2025-14229
MEDIUM
SourceCodester Inventory Management System 1.0 - Code Injection
CVSS 4.7
CVE-2025-51735
HIGH
HCL Technologies Ltd. Unica 12.0.0. - Code Injection
CVSS 7.5
CVE-2025-13133
MEDIUM
Simple User Import Export <1.1.7 - Code Injection
CVSS 6.6
CVE-2025-12249
MEDIUM
Axosoft Scrum and Bug Tracking 22.1.1.11545 - Code Injection
CVSS 6.3
CVE-2025-11576
MEDIUM
AI Chatbot Free Models - Customer Support, Live Chat, Virtual Assis...
CVSS 4.3
CVE-2025-60852
MEDIUM
Instant Developer Foundation <25.0.9600 - Code Injection
CVSS 6.5
CVE-2025-62417
HIGH
Bagisto < 2.3.8 - CSV Formula Injection via Product Data Export
CVSS 7.8
CVE-2025-11498
MEDIUM
B&R Automation Runtime <6.4 - Info Disclosure
CVSS 6.1
CVE-2025-11254
MEDIUM
Contest Gallery <27.0.3 - Code Injection
CVSS 4.3
CVE-2025-11279
MEDIUM
Axosoft Scrum and Bug Tracking 22.1.1.11545 - CSV Injection
CVSS 5.5
Details
Vulnerabilities
292