CVE-2018-9106

CVE-2018-9106 affects the Joomla! AcySMS extension prior to 3.5.1. The vulnerability is a CSV Injection/Formula Injection in the export feature, where a value mishandled in a CSV export can be exploited. Documented impact includes CSV injections via exported data, potentially enabling adversaries...

CVE-2018-9106: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export...

CVE-2018-9107: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export...

GHSA-6494-V9FQ-FGQ2 Keystone is vulnerable to CSV injection

CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...

WordPress WordCamp Talks plugin <= 1.0.0-beta2 - Formula injection via CSV exports

The WordCamp Talks plugin does not sanitize CSV exports properly, which can lead to spreadsheet formula injection via malicious user input. Solution Update the plugin...

KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vulnerability

KeystoneJS version 4.0.0-beta.5 suffers from an unauthenticated CSV injection vulnerability in admin/server/api/download.js and lib/list/getCSVData.js Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contac...

KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection

Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15879 Vendor...

CVE-2017-15879

CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...

CVE-2017-15879

CSV Injection aka Excel Macro Injection or Formula Injection exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export...

CVE-2017-15879

CVE-2017-15879 affects KeystoneJS before 4.0.0-beta.7. The CSV injection vulnerability arises in the CSV export path via values mishandled in admin/server/api/download.js and lib/list/getCSVData.js, enabling Excel macro/formula injection. Documentation indicates the issue exists prior to version ...

WordCamp Talks <= 1.0.0-beta2 - Formula injection via CSV exports

Fixed in version 1.0.0-beta3...

Ian Dunn: Formula injection via CSV exports in WordCamp Talks plugin

The WordCamp Talks plugin does not attempt to sanitize CSV exports, which can lead to spreadsheet formula injection via malicious inputs. POC ======== Submit a new talk with the title of =1+1. Visit the All Talks page /wp-admin/edit.php?posttype=talks Click the CSV Export link Open the downloaded...

CVE-2017-1000039

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

CVE-2017-1000039

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

Design/Logic Flaw

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

CVE-2017-1000039: Improper Input Validation

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

CVE-2017-1000039

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

CVE-2017-1000039

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution...

CVE-2017-1000039

The CVE-2017-1000039 entry concerns Framadate version 1.0, specifically its CSV Export component. The connected sources confirm a vulnerability in the CSV Export that enables Formula Injection, leading to information disclosure and potential code execution. The root cause is the CSV export handli...

PT-2017-10749

Name of the Vulnerable Software and Affected Versions Framadate version 1.0 Description The issue concerns Formula Injection in the CSV Export, which could lead to Information Disclosure and Code Execution. Recommendations For Framadate version 1.0, update to a version that fixes the Formula...