PT-2026-84595

Name of the Vulnerable Software and Affected Versions Baserow version 2.3.3 Description An issue exists in the index formula function where a low-privileged authenticated user with permissions to create or modify formula fields can provide an undocumented fourth argument. This argument is treated...

CVE-2026-19754: Improper Neutralization of Special Elements used in an SQL Command

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...

EUVD-2026-67777

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

EUVD-2026-42997

Snipe-IT has CSV formula injection in Activity Report export...

Snipe-IT has CSV formula injection in Activity Report export

Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...

GHSA-WHRX-MMGR-GPCF Snipe-IT has CSV formula injection in Activity Report export

Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport and written with plain fputcsv. A low-privileged authenticated user can set a...

SUSE CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

PT-2026-83275

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797: Improper Neutralization of Formula Elements in a CSV File

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-56652

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

EUVD-2026-67128

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652

Dool (versions up to 1.3.8 ) is affected by a CSV injection vulnerability in its CSV export functionality. The tool fails to sanitize cell content beginning with special formula characters (=, +, -, or @), allowing a local attacker to craft a process name starting with one of these characters, th...

CVE-2026-56652 Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...

CVE-2026-56652: Improper Neutralization of Formula Elements in a CSV File

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...