CVE-2026-102799

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

EUVD-2026-112025

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102799

The iCagenda Joomla extension (versions 3.2.1 to 4.0.16 ) is vulnerable to CSV formula injection within the registrations export functionality. This vulnerability occurs because names or notes starting with an equals sign (= ) are not properly neutralized, allowing them to execute as formulas whe...

CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

PT-2026-127210

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

PT-2026-127211

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154

The open source CRM application EspoCRM is vulnerable to CSV/Formula Injection in versions prior to 9.3.9 . The root cause is a sanitizer bypass in sanitizeCellValue() within Processor.php files for CSV and XLSX formats, which only inspect the first byte. An authenticated low-privileged user can ...

CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396

The Thelia platform (versions before 3.1.2 and 3.2.x before 3.2.1 ) is vulnerable to a CSV formula injection vulnerability. The issue resides in the CSVSerializer component, which exports fields like registration, checkout, or newsletter data verbatim. Unauthenticated visitors can exploit this by...

EUVD-2026-97493

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

PT-2026-110625

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.2 Thelia versions 3.2.x prior to 3.2.1 Description An issue exists where unauthenticated visitors can perform CSV formula injection by providing specially crafted data in registration, checkout, or newsletter field...

CVE-2026-109396: Improper Neutralization of Formula Elements in a CSV File

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-108579

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...