CVE-2021-42292

CVE-2021-42292 Dieses Paket erkennt Exploits von CVE-2021-42292, einer lokalen Privilegieneskalationsschwachstelle in Microsoft Excel, und erzeugt einen Eintrag in notice.log. https://corelight.com/blog/detecting-cve-2021-42292 Erkennungsmethode: Das Paket erkennt die Schwachstelle, wenn die...

perl_spreadsheet_excel_rce_poc

Vulnerabilità di sicurezza di ParseExcel TL;DR: RCE dalla logica nel parsing delle stringhe di formato. Breve spiegazione dell'exploit La causa principale dell'exploit deriva dalla chiamata di eval su un input utente non validato in Utility.pm...

cypheroth

Cypheroth Set di strumenti automatizzati ed estensibili che esegue query Cypher contro il backend Neo4j di Bloodhound e salva l'output in fogli di calcolo. Descrizione Questo è uno script bash che automatizza l'esecuzione di query Cypher sui dati di Bloodhound memorizzati in un database Neo4j. Mi...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...

EUVD-2026-67777

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2024-53924

CVE-2024-53924 Descrizione: Pycel fino alla versione 1.0b30, quando opera su un foglio di calcolo non affidabile, consente l'esecuzione di codice tramite una formula appositamente creata in una cella, come ad esempio una che inizia con la sottostringa =IFA1=200, eval"import'os'.system. Autore:...

CVE-2025-48129

🚨 CVE-2025-48129 - Escalation dei Privilegi nel Plugin Spreadsheet Price Changer per WordPress 🛡️ Riepilogo della Vulnerabilità Plugin Coinvolto : Spreadsheet Price Changer per WooCommerce e WP E-commerce – Light Versioni Vulnerabili : Classificato sotto: OWASP A7 – Fallimenti di Identificazione e...

Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion

A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. id: CVE-2023-29887 info: name: Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion author: ctflearner severity: high description: | A Local...

xlsx

SheetJS La SheetJS Community Edition offre soluzioni open-source collaudate per estrarre dati utili da quasi qualsiasi foglio di calcolo complesso e generare nuovi fogli di calcolo che funzioneranno con software sia legacy che moderni. SheetJS Pro offre soluzioni che vanno oltre l'elaborazione de...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: Iniezione CSV in Instant Developer Foundation 25.0.9600 – Prova di concetto PoC 📌 Panoramica Questo repository contiene una prova di concetto PoC per una vulnerabilità di iniezione CSV Formula Injection CVE-2025-60852 che interessa le applicazioni realizzate con il framework Insta...

EUVD-2026-67128

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CSV Injection

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...

CVE-2026-78209

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...

CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...

EUVD-2026-64684

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...

CVE-2026-19501 CVE-2026-19501

CSV export functionality in Brainstorm Force SureForms version, = 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the...

PT-2026-77149

Name of the Vulnerable Software and Affected Versions Brainstorm Force SureForms versions prior to 2.12.2 Description The CSV export functionality fails to neutralize spreadsheet formula characters in user-controlled form field names before generating exports. This allows a remote attacker to...

CVE-2026-47705

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later execute...