CVE-2021-41128 CSV Injection Vulnerability in Hygeia

Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports Statistics & BAG MED contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get...

CVE-2021-41128

Hygeia CSV Exports (Statistics & BAG MED) are vulnerable to CSV injection due to lack of validation/sanitization of formula fields in affected versions. Malicious input in exported fields can be executed when ingested. The issue has been fixed in version 1.30.4; upgrading is advised. No workaroun...

GHSA-XRPJ-F9V6-2332 CSV injection in Craft CMS

Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...

CSV Injection

craftcms/cms is vulnerable to CSV injection. Lack of some sanity/escaping check prior to inserting the data to the CSV document allows an attacker to inject malicious input...

CSV injection in shuup

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and...

GHSA-663J-RJCR-789F CSV injection in shuup

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-24016

Fortinet FortiManager vulnerability CVE-2021-24016: An improper neutralization of formula elements in policy-name CSV/Excel fields can lead to arbitrary shell commands when a crafted IPv4 field is included and the exported configuration file is opened unsafely. Affected are FortiManager 6.4.3 and...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

Design/Logic Flaw

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before version 3.7.14 is vulnerable to CSV injection via export functionality. The root cause is lack of input sanitization/escaping when exporting data to CSV, allowing crafted input to trigger payloads in CSV readers (e.g., Excel). Affected software is Craft CMS (core) with CSV export...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-25960

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...

CVE-2021-25960

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...

Input validation

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...