CVE-2026-81728 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

CVE-2026-81728

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

CVE-2026-81728 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652

Dool (versions up to 1.3.8 ) is affected by a CSV injection vulnerability in its CSV export functionality. The tool fails to sanitize cell content beginning with special formula characters (=, +, -, or @), allowing a local attacker to craft a process name starting with one of these characters, th...

EUVD-2026-67128

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

PT-2026-82540

Name of the Vulnerable Software and Affected Versions Dool versions prior to 1.3.9 Description The software is susceptible to CSV injection during the data export process to CSV files. This occurs because the application fails to sanitize cell content that begins with special formula characters...

CHIRP chirp-next-20260814 Arbitrary Code Execution

CHIRP's Kenwood ITM file format driver passes raw CSV field values from an opened file directly to Python's built-in eval with no validation. An attacker who delivers a crafted file to a CHIRP user achieves arbitrary code execution as the victim user. CHIRP — Arbitrary Code Execution via eval in...

CVE-2026-56652: Improper Neutralization of Formula Elements in a CSV File

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

PT-2026-82745

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the GETPOST'updatekeys','array' function in htdocs/imports/import.php, applying...

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

Security Bulletin: Vulnerability in json-2-csv affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in json-2-csv has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability

Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability discovered by Duy Tran in WordPress Plugin Everest Forms versions 3.5.0...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

[SECURITY] Fedora 43 Update: libxls-1.6.3-5.fc43

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...