CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

298 vulnerabilities with CWE-1236
CVE-2023-23678 MEDIUM
WPEkaClub WP Cookie Consent <2.2.5 - Info Disclosure
CVSS 4.0
CVE-2023-22719 MEDIUM
GiveWP < 2.25.1 - CSV Injection
CVSS 4.7
CVE-2023-43071 MEDIUM
Dell SmartFabric Storage Software <1.4 - XSS
CVSS 4.4
CVE-2023-22877 HIGH
IBM InfoSphere Information Server 11.7 - Code Injection
CVSS 7.0
CVE-2023-38843 HIGH
Atlos 1.0 - Authenticated Remote Code Execution via Incident Description Field
CVSS 8.0
CVE-2023-4006 CRITICAL
thorsten/phpmyfaq <3.1.16 - Info Disclosure
CVSS 9.8
CVE-2023-37219 HIGH
Tadiran Telecom Composit - SQL Injection
CVSS 7.3
CVE-2023-3527 MEDIUM
Avaya CMS Supervisor - Code Injection
CVSS 6.8
CVE-2023-28958 HIGH
IBM Watson Knowledge Catalog - Code Injection
CVSS 7.0
CVE-2023-3493 HIGH
fossbilling <0.5.3 - Info Disclosure
CVSS 8.0
CVE-2023-3302 HIGH
admidoi/admidio <4.2.9 - Info Disclosure
CVSS 7.8
CVE-2023-31867 HIGH
Sage X3 <12.14.0.50-0 - Code Injection
CVSS 7.2
CVE-2023-0721 HIGH
Metform Elementor Contact Form Builder <3.3.0 - Code Injection
CVSS 8.3
CVE-2023-33410 HIGH
Minical <= 1.0.0 - CSV Injection via Customer Name Field
CVSS 8.8
CVE-2023-2629 HIGH
pimcore/customer-data-framework <3.3.9 - Info Disclosure
CVSS 7.8
CVE-2023-29918 MEDIUM
RosarioSIS 10.8.4 - CSV Injection via Periods Module
CVSS 5.4
CVE-2023-25348 HIGH
ChurchCRM 4.5.3 - CSV Injection via Last Name and First Name Input Fields
CVSS 7.8
CVE-2023-2258 HIGH
GitHub alfio-event/alf.io <2.0-M4-2304 - Info Disclosure
CVSS 8.8
CVE-2023-29109 MEDIUM
SAP Application Interface Framework - Code Injection
CVSS 4.4
CVE-2023-25611 MEDIUM
Fortinet FortiAnalyzer <7.2.1 - Code Injection
CVSS 4.0
CVE-2022-3604 HIGH
Contact Form Entries <1.3.0 - Code Injection
CVSS 7.8
CVE-2022-44738 MEDIUM
Patrick Robrecht Posts and Users Stats <1.1.3 - Info Disclosure
CVSS 5.8
CVE-2022-42882 MEDIUM
Shambix Simple CSV/XLS Exporter <1.5.8 - Info Disclosure
CVSS 5.8
CVE-2022-41616 HIGH
Kaushik Kalathiya Export Users Data CSV - Info Disclosure
CVSS 7.6
CVE-2022-38702 MEDIUM
Nakashima Masahiro WP CSV Exporter <2.0 - Info Disclosure
CVSS 5.8
Details
Vulnerabilities 298
Links
MITRE CWE Entry Search this CWE With Exploits