CWE-1236

Improper Neutralization of Formula Elements in a CSV File

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

298 vulnerabilities with CWE-1236
CVE-2022-3558 HIGH
WordPress Plugin <1.20.5 - Info Disclosure
CVSS 8.0
CVE-2022-3463 CRITICAL
WordPress Contact Form Plugin <4.3.13 - Code Injection
CVSS 9.8
CVE-2022-22425 CRITICAL
IBM InfoSphere Information Server 11.7 - Code Injection
CVSS 9.8
CVE-2022-40294 HIGH
php_point_of_sale - CSV Injection in Data Export Functionality
CVSS 8.8
CVE-2022-3393 CRITICAL
Post to CSV by BestWebSoft <1.4.0 - Code Injection
CVSS 9.8
CVE-2022-40472 HIGH
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 - Code Injection
CVSS 8.0
CVE-2022-38061 MEDIUM
WordPress Export Post Info <1.2.0 - CSV Injection
CVSS 6.2
CVE-2022-38844 HIGH
EspoCRM 7.1.8 - Authenticated CSV Injection via Contact Creation
CVSS 8.0
CVE-2022-2798 HIGH
WordPress Affiliate Mgr <2.9.14 - Code Injection
CVSS 8.0
CVE-2022-1194 HIGH
Mobile Events Manager <1.4.8 - Code Injection
CVSS 8.8
CVE-2022-3026 MEDIUM
WP Users Exporter <1.4.2 - Code Injection
CVSS 6.5
CVE-2022-2429 MEDIUM
Ultimate SMS Notifications for WooCommerce <1.4.1 - Code Injection
CVSS 6.5
CVE-2022-2240 HIGH
Request a Quote WP <2.3.7 - Code Injection
CVSS 8.8
CVE-2022-1539 HIGH
Exports and Reports WP <0.9.2 - Code Injection
CVSS 8.8
CVE-2022-2112 HIGH
inventree/inventree <0.7.2 - Info Disclosure
CVSS 8.8
CVE-2022-1202 HIGH
WP-CRM < 1.2.1 - CSV Injection via Unsanitized Export Fields
CVSS 7.8
CVE-2022-2027 HIGH
kromitgmbh/titra <0.77.0 - Info Disclosure
CVSS 8.0
CVE-2022-26867 MEDIUM
PowerStore SW v2.1.1.0 - Code Injection
CVSS 5.9
CVE-2022-28481 CRITICAL
CSV-Safe gem < 3.0.0 - Code Injection
CVSS 9.8
CVE-2022-1544 HIGH
luya/yii-helpers < 1.2.1 - CSV Injection via Improper Neutralization of Formula Elements
CVSS 7.8
CVE-2022-29315 HIGH
Invicti Acunetix <14 - Code Injection
CVSS 8.8
CVE-2022-0142 CRITICAL
Visual Form Builder <3.0.8 - Code Injection
CVSS 9.8
CVE-2022-23868 HIGH
RuoYi v4.7.2 - CSV Injection via Log File Export
CVSS 7.8
CVE-2022-26249 CRITICAL
Survey King v0.3.0 - Code Injection
CVSS 9.8
CVE-2022-24770 HIGH
gradio < 2.8.11 - CSV Injection via Flagging Functionality
CVSS 8.8
Details
Vulnerabilities 298
Links
MITRE CWE Entry Search this CWE With Exploits