PT-2023-20587

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.3.9 Description The issue concerns improper neutralization of formula elements in a CSV file, which can lead to formula injection or CSV injection. This vulnerability affects input fields suc...

Admidio 4.2.5 CSV Injection

Exploit Title: admidio v4.2.5 - CSV Injection Application: admidio Version: 4.2.5 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.admidio.org/ Software Link: https://www.admidio.org/download.php Date of found: 26.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2. Technical Detail...

phpMyFAQ 3.1.12 CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

GHSA-F8HP-GRMR-PP7J RosarioSIS vulnerable to CSV Injection

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

RosarioSIS vulnerable to CSV Injection

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

Input validation

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

admidio v4.2.5 - CSV Injection Vulnerability

Exploit Title: admidio v4.2.5 - CSV Injection Application: admidio Version: 4.2.5 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.admidio.org/ Software Link: https://www.admidio.org/download.php Date of found: 26.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2. Technical Detail...

phpMyFAQ v3.1.12 - CSV Injection Vulnerability

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

CVE-2023-29918: Improper Neutralization of Formula Elements in a CSV File

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

CVE-2023-29918

CVE-2023-29918 affects RosarioSIS 10.8.4, with a CSV injection vulnerability in the Periods Module. Root cause: CSV injection in a module used for reporting/exports. Impact as per CVSS: Confidentiality and Integrity Low, Availability None; Attack Vector Network, User Interaction Required, Privile...

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

admidio v4.2.5 - CSV Injection

Exploit Title: admidio v4.2.5 - CSV Injection Application: admidio Version: 4.2.5 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.admidio.org/ Software Link: https://www.admidio.org/download.php Date of found: 26.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2. Technical Detail...

phpMyFAQ v3.1.12 - CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection

Software Emails & Newsletters with Jackmail Type Plugin Vulnerable versions = 1.2.22 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-46821 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 513c44c8232d Credits Mika Required privilege...

ChurchCRM CSV Injection Vulnerability

ChurchCRM is an open source CRM system for churches. ChurchCRM v4.5.3 suffers from a CSV injection vulnerability that stems from improperly neutralizing a formula element via the last name and first name input fields when creating a new account, which can be exploited by an attacker to execute...

CVE-2023-25348

ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file...