EUVD-2026-125232

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

PT-2026-146620

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can...

CVE-2026-108563

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet...

EUVD-2026-123627

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet...

CVE-2026-108563

Revive Adserver versions 6.0.8 and earlier are vulnerable to a spreadsheet formula injection in conversion-tracking report exports. An unauthenticated attacker can submit conversion values that are written as formulas rather than plain text in the generated XLS workbook . When a user opens the ex...

CVE-2026-108563: Revive Adserver: Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an…

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet...

Part-DB input validation error vulnerability

Versions of Part-DB prior to 2.13.2 contain an input validation error vulnerability. This flaw arises from the failure to sanitize spreadsheet formula characters within the part import/export workflows. Authenticated users with import privileges can upload CSV files containing formula prefix...

PT-2026-99200

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The Control UI fails to neutralize leading characters that spreadsheet applications interpret as formulas when exporting session data to CSV. A lower-trust participant capable of influencing a...

CVE-2026-73195

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-73195: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

EUVD-2026-76058

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-86745

Snipe-IT (IT asset management) master-branch builds after 8.6.3 are vulnerable to CSV Formula Injection in the Location-Scoping Export. The SettingsController::downloadLocationScopingReport endpoint (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call witho...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write, writeBuffe...

CSV Injection

Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by...

CSV Injection

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection through the postActivityReport process. An attacker can cause arbitrary formula execution in spreadsheet software by injecting a specially crafted User-Agent...

CVE-2026-55452

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction stores the request User-Agent header and ReportsController::postActivityReport writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a...

CVE-2026-46672

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not...