CVE-2026-102799

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

EUVD-2026-112025

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

CVE-2026-102799

The iCagenda Joomla extension (versions 3.2.1 to 4.0.16 ) is vulnerable to CSV formula injection within the registrations export functionality. This vulnerability occurs because names or notes starting with an equals sign (= ) are not properly neutralized, allowing them to execute as formulas whe...

CVE-2023-36250

CVE-2023-36250 CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. Vulnerability Type CSV Injection Discoverer Bruno Teixeira Reference http://gnome.com Affected Product Code Base GNOME...

hdwebmobile-formula-pricing

HDWebmobile Formula Pricing Price a product from customer-entered numbers using a formula -- evaluated safely, never with PHP's eval. WordPress.org: https://wordpress.org/plugins/hdwebmobile-formula-pricing/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or later Description...

CVE-2024-53924

CVE-2024-53924 Description: Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring. Author: Adham Elmosalamy @aelmo Date of Disclosure: November 23, 2024...

cve-2024-43425

CVE-2024-43425 Firmware info: Application name: Moodle Build version: moodle-4.4.1 Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions Download link: moodle-4.4.1 Description and Impact Attackers with permission to create or modify questions...

salt-shellshock

====================== shellshock bash update This recipe tries to upgrade bash from OS pkg, and falls back to compile bash on systems with no update available. Works for us on old ubuntu/debian. Bash install script from:...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: CSV Injection in Instant Developer Foundation 25.0.9600 – Proof of Concept PoC 📌 Overview This repository contains a Proof of Concept PoC for a CSV Injection Formula Injection vulnerability CVE-2025-60852 affecting applications built with the Instant Developer Foundation framework...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2022-44830

Suggested description Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Information Proof ...

nanoDLP unauthenticated G-code injection RCE

Guest POST /formula evaluates JavaScript with nanodlpContext; ShieldUnpause is persisted via Config.Save, then GET /printer/unpause executes Exec cmd as root. !/usr/bin/env python3 -- coding: utf-8 -- """nanoDLP unauthenticated G-code injection RCE via /formula and /printer/unpause.""" from futur...

CVE-2024-29375

CSV-Injection-PoC CSV Injection in Addactis IBNRS 3.10.3.107 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, Impact Score: 5.3, Exploitation Score: 1.3 Affected Components: Project Description, Identifiers, Custom Triangle Name inside Input Triangles and Yield Curve Name parameters Screenshot 1:...

PT-2026-127211

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16...

PT-2026-127210

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

CVE-2026-86020

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020

The open-source inventory management system Part-DB (prior to version 2.13.2 ) is vulnerable to a spreadsheet formula injection in its part import/export workflow. An authenticated user with import permissions can upload a CSV file containing formula-prefixed values (e.g., =1+1) into user-control...