CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

EUVD-2026-67128

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652

Dool (versions up to 1.3.8 ) is affected by a CSV injection vulnerability in its CSV export functionality. The tool fails to sanitize cell content beginning with special formula characters (=, +, -, or @), allowing a local attacker to craft a process name starting with one of these characters, th...

CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

PT-2026-82745

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the GETPOST'updatekeys','array' function in htdocs/imports/import.php, applying...

CVE-2026-56652: Improper Neutralization of Formula Elements in a CSV File

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CHIRP chirp-next-20260814 Arbitrary Code Execution

CHIRP's Kenwood ITM file format driver passes raw CSV field values from an opened file directly to Python's built-in eval with no validation. An attacker who delivers a crafted file to a CHIRP user achieves arbitrary code execution as the victim user. CHIRP — Arbitrary Code Execution via eval in...

PT-2026-82540

Name of the Vulnerable Software and Affected Versions Dool versions prior to 1.3.9 Description The software is susceptible to CSV injection during the data export process to CSV files. This occurs because the application fails to sanitize cell content that begins with special formula characters...

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

Security Bulletin: Vulnerability in json-2-csv affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in json-2-csv has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability

Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability discovered by Duy Tran in WordPress Plugin Everest Forms versions 3.5.0...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

[SECURITY] Fedora 43 Update: libxls-1.6.3-5.fc43

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...

CVE-2026-78136

A flaw was found in CHIRP from chirpmyradio. A local attacker can achieve arbitrary code execution by tricking a user into processing a specially crafted Comma Separated Values CSV file. This vulnerability, an eval injection, occurs within the cleantmode function when handling CSV data, leading t...

CVE-2026-78391

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...