CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

292 vulnerabilities with CWE-1236
CVE-2024-47485 CRITICAL
HikCentral Master Lite - Code Injection
CVSS 9.8
CVE-2024-27321 HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File in Multilabel Classification Task
CVSS 7.8
CVE-2024-27320 HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File
CVSS 7.8
CVE-2024-41226 HIGH
Automation Anywhere Automation 360 <21094 - Code Injection
CVSS 7.8
CVE-2024-3232 HIGH
Tenable Identity Exposure - Code Injection
CVSS 7.6
CVE-2024-27785 MEDIUM
Fortinet FortiAIOps 2.0.0 - Authenticated CSV Injection via Poisoned Reports
CVSS 5.4
CVE-2024-28764 MEDIUM
IBM WebSphere Automation 1.7.0 - Command Injection
CVSS 6.5
CVE-2024-3214 MEDIUM
Relevanssi - A Better Search <4.22.1 - Code Injection
CVSS 5.8
CVE-2024-25007 HIGH
Ericsson Network Manager <23.1 - XSS
CVSS 7.1
CVE-2024-29375 CRITICAL
Addactis IBNRS <3.10.3.107 - Code Injection
CVSS 9.8
CVE-2024-28111 MEDIUM
thinkst/canarytokens < sha-c595a1f8 - CSV Injection via Incident History Export
CVSS 6.5
CVE-2024-24337 HIGH
Koha Library Management System <23.05.05 - CSV Injection
CVSS 8.0
CVE-2023-54348 HIGH
ERPGo SaaS 3.9 CSV Injection via Vendor Creation
CVSS 8.8
CVE-2023-53929 HIGH
phpMyFAQ 3.1.12 - Authenticated CSV Injection via User Profile Export
CVSS 8.8
CVE-2023-53913 HIGH
Rukovoditel 3.3.1 - Authenticated CSV Injection via Firstname Field
CVSS 8.8
CVE-2023-53905 HIGH
ProjectSend r1605 - Authenticated CSV Injection via User Profile Name Field
CVSS 8.0
CVE-2023-47295 CRITICAL
NCR Terminal Handler 1.5.1 - Command Injection
CVSS 9.8
CVE-2023-51336 HIGH
PHPJabbers Meeting Room Booking System v1.0 - Code Injection
CVSS 8.8
CVE-2023-51333 HIGH
PHPJabbers Cinema Booking System v1.0 - Code Injection
CVSS 8.8
CVE-2023-51319 HIGH
PHPJabbers Bus Reservation System v1.1 - Code Injection
CVSS 8.8
CVE-2023-51311 HIGH
PHPJabbers Car Park Booking System v3.0 - Code Injection
CVSS 8.8
CVE-2023-51302 HIGH
PHPJabbers Hotel Booking System <4.0 - Code Injection
CVSS 8.8
CVE-2023-51298 MEDIUM
PHPJabbers Event Booking Calendar v4.0 - Code Injection
CVSS 4.7
CVE-2023-46401 CRITICAL
KWHotel 0.47 - CSV Formula Injection in Invoice Adding Function
CVSS 9.8
CVE-2023-46400 CRITICAL
KWHotel 0.47 - CSV Formula Injection in Add Guest Function
CVSS 9.8
Details
Vulnerabilities 292
Links
MITRE CWE Entry Search this CWE With Exploits