CVE-2021-46363

CVE-2021-46363: Inyección de fórmulas en Magnolia CMS Un problema en la función Export de Magnolia v6.2.3 y versiones anteriores permite a los atacantes realizar ataques de inyección de fórmulas mediante archivos CSV/XLS manipulados. Estas fórmulas pueden provocar la ejecución de código arbitrari...

CVE-2026-89246

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-89246

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is affected by a CSV formula injection vulnerability in the myComments.download.php endpoint. The root cause is a failure to sanitize spreadsheet formula prefixes (=, +, -, @) in comment text before CSV export. An authenticated...

EUVD-2026-76058

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-89246 WWBN AVideo CSV Formula Injection via myComments.download.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-86745

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

EUVD-2026-74922

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86745

Snipe-IT (IT asset management) master-branch builds after 8.6.3 are vulnerable to CSV Formula Injection in the Location-Scoping Export. The SettingsController::downloadLocationScopingReport endpoint (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call witho...

EUVD-2026-74919

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

cve-2024-43425

CVE-2024-43425 固件信息： 应用名称：Moodle 构建版本：moodle-4.4.1 受影响版本：4.4 至 4.4.1、4.3 至 4.3.5、4.2 至 4.2.8、4.1 至 4.1.11，以及之前不受支持的版本 下载链接：moodle-4.4.1 描述与影响 拥有在 Moodle 课程中创建或修改问题权限的攻击者，可以为计算题构造恶意输入，进而可能被滥用以在底层系统上执行任意命令。 根本原因 函数 qtypecalculatedfindformulaerrors 用于确保在 Moodle 中输入的公式的有效性，防止语法错误。 变量会被替换为数字...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852：Instant Developer Foundation（ 25.0.9600）中的 CSV 注入 – 概念验证（PoC） 📌 概述 本仓库包含一个 CSV 注入（公式注入） 漏洞（CVE-2025-60852）的概念验证（PoC），该漏洞影响使用 Instant Developer Foundation 框架（25.0.9600 之前的版本）构建的应用程序。使用受影响框架构建的应用程序在导出 CSV 格式数据时，未正确清理用户提供的输入。 因此，Microsoft Excel 或 LibreOffice Calc 等电子表格软件会将某些值解释为公式。...

CVE-2023-36250

CVE-2023-36250 GNOME time tracker 버전 3.0.2의 CSV 인젝션 취약점으로, 로컬 공격자가 새 레코드를 생성할 때 조작된 .tsv 파일을 통해 임의 코드를 실행할 수 있습니다. 취약점 유형 CSV 인젝션 발견자 Bruno Teixeira 참고 http://gnome.com 영향을 받는 제품 코드 베이스 GNOME time tracker v3.0.2 PoC cmdline 필드에 수식=3+3을 사용하여 새 레코드를 생성하면, .tsv로 내보낼 때 수식을 주입할 수 있는 방법이 생성됩니다. 이렇게 하면...

CVE-2026-86257

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...