CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: CSV Injection in Instant Developer Foundation 25.0.9600 – Proof of Concept PoC 📌 Overview This repository contains a Proof of Concept PoC for a CSV Injection Formula Injection vulnerability CVE-2025-60852 affecting applications built with the Instant Developer Foundation framework...

cve-2024-43425

CVE-2024-43425 Firmware info: Application name: Moodle Build version: moodle-4.4.1 Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions Download link: moodle-4.4.1 Description and Impact Attackers with permission to create or modify questions...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

CVE-2023-36250

CVE-2023-36250 CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. Vulnerability Type CSV Injection Discoverer Bruno Teixeira Reference http://gnome.com Affected Product Code Base GNOME...

CVE-2026-102799

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

EUVD-2026-112025

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102799

The iCagenda Joomla extension (versions 3.2.1 to 4.0.16 ) is vulnerable to CSV formula injection within the registrations export functionality. This vulnerability occurs because names or notes starting with an equals sign (= ) are not properly neutralized, allowing them to execute as formulas whe...

CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

PT-2026-127211

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

PT-2026-127210

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

CVE-2026-86020

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

EUVD-2026-108580

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020

The open-source inventory management system Part-DB (prior to version 2.13.2 ) is vulnerable to a spreadsheet formula injection in its part import/export workflow. An authenticated user with import permissions can upload a CSV file containing formula-prefixed values (e.g., =1+1) into user-control...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

PT-2026-121754

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154

The open source CRM application EspoCRM is vulnerable to CSV/Formula Injection in versions prior to 9.3.9 . The root cause is a sanitizer bypass in sanitizeCellValue() within Processor.php files for CSV and XLSX formats, which only inspect the first byte. An authenticated low-privileged user can ...