EIP-2026-104957

This exploit demonstrates a CSV injection vulnerability in admidio v4.2.5, where a user can inject a malicious payload into their profile's postal code field. When an admin exports user data as a CSV file, the payload executes arbitrary commands (e.g., opening the calculator) on the admin's machine.