6770 matches found
CVE-2026-78136
A flaw was found in CHIRP from chirpmyradio. A local attacker can achieve arbitrary code execution by tricking a user into processing a specially crafted Comma Separated Values CSV file. This vulnerability, an eval injection, occurs within the cleantmode function when handling CSV data, leading t...
CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook
RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...
CVE-2026-78391
RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...
EUVD-2026-64891
RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...
CSV Injection
Overview Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write, writeBuffe...
CSV Injection
Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by...
CSV Injection
Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...
CVE-2026-78209
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78209
exceljs-hardened versions before 5.0.0 are vulnerable to CSV formula injection . The library fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. An attacker who can influence exported cell values can inject spreadsheet formulas that execute when the ...
EUVD-2026-64684
exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...
CVE-2026-78209
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78209: Improper Neutralization of Formula Elements in a CSV File
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...
CVE-2026-78391: Improper Neutralization of Input During Web Page Generation
RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...
PT-2026-79802
Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description Insufficient neutralization of leading equals =, plus +, minus -, or at @ signs in cell values written to CSV output allows for CSV Injection. This occurs when attackers influence exported...
CVE-2026-78136
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...