CVE-2022-31081

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served ...

CVE-2022-2112

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2...

InvenTree 安全漏洞

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A CSV injection vulnerability exists in InvenTree versions prior to 0.7.2, which stems from an application that does not filter the escaping of...

PT-2022-14864

Name of the Vulnerable Software and Affected Versions inventree versions prior to 0.7.2 Description The issue is related to the improper neutralization of formula elements in a CSV file. This problem affects the inventree GitHub repository. Recommendations For versions prior to 0.7.2, update to...

PT-2022-14123 · WordPress · Export Any Wordpress Data To Xml/Csv

Name of the Vulnerable Software and Affected Versions: Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.3.5 Description: The issue arises from the lack of sanitization of the cpt POST parameter when exporting post data, which is then used in a database query. This leads t...

CVE-2022-2027

Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0...

titra 安全漏洞

titra is a modern open source time tracking project for freelancers and small teams. A security vulnerability exists in versions prior to titra 0.77.0, which stems from improperly neutralized formula elements in CSV files...

SevOne Network Management System 安全漏洞

SevOne Network Management System is the most comprehensive, scalable and application-centric network performance monitoring system for modern NetOps from SevOne. A CSV injection vulnerability exists in SevOne Network Management System versions 5.7.2.0 inclusive through 5.7.2.22 inclusive, which c...

CVE-2019-12351

An issue was discovered in zzcms 2019. SQL Injection exists in dl/dlprint.php via an id parameter value with a trailing comma...

CVE-2019-12350

An issue was discovered in zzcms 2019. SQL Injection exists in dl/dldownload.php via an id parameter value with a trailing comma...

PT-2022-13965 · WordPress · Quotes Llama Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Quotes llama WordPress plugin versions prior to 1.0.0 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed. This can be achieved by exploiting the...

GHSA-8Q4V-35V6-G8WR Mattermost Server is vulnerable CSV Injection

An issue was discovered in Mattermost Server before 4.0.4 and 3.10.3. It allows CSV injection via a compliance report...

CSV Injection

Overview csv-safe is a decorates the ruby CSV library to sanitize output CSV against CSV injection attacks. Affected versions of this package are vulnerable to CSV Injection by not filtering out special characters % and |. Remediation Upgrade csv-safe to version 3.0.0 or higher. References - GitH...

WordPress plugin Import and export users and customers 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Import and export users and customers plugin...

CVE-2022-1544

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained...

CSV-Safe gem 安全漏洞

The CSV-Safe gem is a library to prevent CSV injection attacks. A security vulnerability exists in versions of the CSV-Safe gem prior to 3.0.0 that stems from not however filtering out special characters that could trigger CSV injection...

PT-2022-11368 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 3.0.0-beta6 Description: The issue affects Combodo iTop, a web-based IT Service Management tool. In the affected versions, the export CSV page does not properly escape user-supplied parameters, allowing for...

CVE-2022-29315

Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used...

CVE-2021-23286

Eaton Intelligent Power Manager Infrastructure IPM Infrastructure version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure IPM Infrastructure all version 1.5.0plus205 and prior versions...

CSV Injection

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to CSV Injection through the csvexport.php API. An attacker can execute arbitrary code or access sensitive information by embedding malicious formulas in the CSV content that is executed when the...