CSV Injection

luyadev/yii-helpers is vulnerable to CSV injection. The vulnerability is possible because the library does not properly neutralize the Firstname and the Lastname, which allows an attacker to inject malicious inputs causing several harmful outcomes such as, client-sided command injection, code...

GHSA-F9P3-H6CG-2CJR Improper neutralization of formula elements in yii-helpers

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained...

Improper neutralization of formula elements in yii-helpers

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained...

CVE-2022-1544

CVE-2022-1544 affects the GitHub project luyadev/yii-helpers prior to 1.2.1. The vulnerability is a CSV/Formula Injection caused by improper neutralization of formula elements in CSV files exported by the library’s Export/CSV path. The practical impact, as stated across sources, includes client-s...

CVE-2022-1544 Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained...

yii-helpers 安全漏洞

yii-helpers is a set of helper classes for the Yii framework, used as LUYA helpers. A security vulnerability exists in the GitHub library luyadev/yii-helpers prior to version 1.2.1, which can be exploited by an attacker to cause effects such as client-side command injection, code execution, or...