EUVD-2026-74919

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2022-44830

建议描述 Sourcecodester Event Registration App v1.0 被发现通过 First Name、Contact 和 Remarks 字段存在多个 CSV 注入漏洞。这些漏洞允许攻击者通过精心制作的 Excel 文件执行任意代码。 附加信息 Proof of Concept: https://drive.google.com/file/d/17rSb8GLFPQfqnVFI56AYffbVMDg8z75t/view?usp=sharing Vendor Homepage:...

cve-2024-43425

CVE-2024-43425 固件信息： 应用名称：Moodle 构建版本：moodle-4.4.1 受影响版本：4.4 至 4.4.1、4.3 至 4.3.5、4.2 至 4.2.8、4.1 至 4.1.11，以及之前不受支持的版本 下载链接：moodle-4.4.1 描述与影响 拥有在 Moodle 课程中创建或修改问题权限的攻击者，可以为计算题构造恶意输入，进而可能被滥用以在底层系统上执行任意命令。 根本原因 函数 qtypecalculatedfindformulaerrors 用于确保在 Moodle 中输入的公式的有效性，防止语法错误。 变量会被替换为数字...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852：Instant Developer Foundation（ 25.0.9600）中的 CSV 注入 – 概念验证（PoC） 📌 概述 本仓库包含一个 CSV 注入（公式注入） 漏洞（CVE-2025-60852）的概念验证（PoC），该漏洞影响使用 Instant Developer Foundation 框架（25.0.9600 之前的版本）构建的应用程序。使用受影响框架构建的应用程序在导出 CSV 格式数据时，未正确清理用户提供的输入。 因此，Microsoft Excel 或 LibreOffice Calc 等电子表格软件会将某些值解释为公式。...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-86257

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...

EUVD-2026-72113

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-85610

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

PT-2026-85506

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

CVE-2026-19754

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

EUVD-2026-69829

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...