107 matches found
EUVD-2026-97493
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
CVE-2026-109396
The Thelia platform (versions before 3.1.2 and 3.2.x before 3.2.1 ) is vulnerable to a CSV formula injection vulnerability. The issue resides in the CSVSerializer component, which exports fields like registration, checkout, or newsletter data verbatim. Unauthenticated visitors can exploit this by...
CVE-2026-108579
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...
EUVD-2026-96362
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...
CVE-2026-108579
OpenPanel versions through 2.3.0 are vulnerable to a CSV formula injection vulnerability via the Cohort Member Export feature. Unauthenticated attackers can supply crafted profile IDs (e.g., =HYPERLINK(...)) to the /track endpoint. When a cohort is exported to a CSV file, these embedded formulas ...
CVE-2026-108579 OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...
CVE-2026-108579 OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...
CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...
CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...
CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...
CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...
CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...
CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...
CVE-2026-89246
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...
CVE-2026-89246
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is affected by a CSV formula injection vulnerability in the myComments.download.php endpoint. The root cause is a failure to sanitize spreadsheet formula prefixes (=, +, -, @) in comment text before CSV export. An authenticated...
CVE-2026-89246 WWBN AVideo CSV Formula Injection via myComments.download.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...
EUVD-2026-76058
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...
CVE-2026-89246 WWBN AVideo CSV Formula Injection via myComments.download.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...
PT-2026-89849
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...
CVE-2026-89246: Improper Neutralization of Formula Elements in a CSV File
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...