CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: Instant Developer Foundation におけるCSVインジェクション（ 25.0.9600）– 概念実証（PoC） 📌 概要 このリポジトリには、Instant Developer Foundation...

cve-2024-43425

CVE-2024-43425 ファームウェア情報: アプリケーション名: Moodle ビルドバージョン: moodle-4.4.1 影響を受けるバージョン: 4.4～4.4.1、4.3～4.3.5、4.2～4.2.8、4.1～4.1.11、およびそれ以前のサポートされていないバージョン ダウンロードリンク: moodle-4.4.1 説明と影響 Moodleのコース内で問題を作成または修正する権限を持つ攻撃者は、計算問題に対して悪意のある入力を生成でき、基盤となるシステム上で任意のコマンドを実行するために悪用される可能性があります。 根本原因...

CVE-2023-36250

CVE-2023-36250 GNOME time tracker バージョン 3.0.2 における CSV インジェクションの脆弱性により、ローカルの攻撃者が新しいレコード作成時に細工された .tsv ファイルを介して任意のコードを実行できる可能性があります。 脆弱性の種類 CSV Injection 発見者 Bruno Teixeira 参照 http://gnome.com 影響を受ける製品コードベース GNOME time tracker v3.0.2 PoC cmdline フィールドで数式（=3+3）を使用して新しいレコードを作成すると、.tsv...

CVE-2021-46363

CVE-2021-46363: Magnolia CMSにおける数式インジェクション Magnolia v6.2.3以前のExport機能における問題により、攻撃者は巧妙に細工されたCSV/XLSファイルを介して数式インジェクション攻撃を実行できます。これらの数式は、Microsoft Excelでエクスポートされたファイルを開いた際に、被害者のコンピュータ上で任意のコード実行を引き起こす可能性があります。 ベンダー開示情報: この脆弱性に関するベンダーの開示情報と修正はこちらで確認できます。 要件: この脆弱性の悪用には以下が必要です: 有効なユーザー資格情報 概念実証（PoC）:...

CVE-2026-100564

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

CVE-2026-100563

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100564

Versions of OpenClaw before 2026.8.1 are vulnerable to CSV Formula Injection . The root cause is a failure to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with the permissions of the spre...

CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

EUVD-2026-87486

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

EUVD-2026-87487

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100563

The OpenClaw npm package (openclaw) before version 2026.8.1 is vulnerable to CSV formula injection . The flaw exists because the Control UI fails to neutralize leading characters interpreted as formulas when exporting session data to CSV. A low-trust participant can influence session labels or th...

CVE-2026-100564: Improper Neutralization of Formula Elements in a CSV File

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

CVE-2026-73195

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-73195

The Apache Syncope identity management tool is vulnerable to an Improper Encoding or Escaping of Output vulnerability. Authenticated users can inject a spreadsheet formula payload into their own plain attributes. If these users are subsequently included in a CSV export , the formula may execute w...

CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...