1316 matches found
Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion
A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. id: CVE-2023-29887 info: name: Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion author: ctflearner severity: high description: | A Local...
perl_spreadsheet_excel_rce_poc
ParseExcel security vulnerabilitiy TL;DR: RCE from logic in parsing format strings. Short explanation on the exploit Root cause of the exploitation comes from calling eval to an unvalidated user input in Utility.pm...
CVE-2021-42292
CVE-2021-42292 This package will detect exploits of CVE-2021-42292, a Microsoft Excel local privilege escalation vulnerability, and generate a notice in notice.log for it. https://corelight.com/blog/detecting-cve-2021-42292 Detection Method: This package detects the vulnerability when the...
CVE-2026-126289
NocoDB versions prior to 2026.06.1 are vulnerable to a CSV formula injection in the export.service.ts component. The root cause is the failure to neutralize record values and column titles that begin with formula characters during CSV exports. This allows low-privileged collaborators or unauthent...
CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC
CVE-2025-60852: CSV Injection in Instant Developer Foundation 25.0.9600 – Proof of Concept PoC 📌 Overview This repository contains a Proof of Concept PoC for a CSV Injection Formula Injection vulnerability CVE-2025-60852 affecting applications built with the Instant Developer Foundation framework...
EUVD-2026-124554
In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button...
CVE-2026-124696
In Progress Kendo UI for jQuery , a Cross-Site Scripting (XSS) vulnerability exists because Spreadsheet sheet names are inserted into the data-sheet-name attribute of the SheetsBar menu button without proper encoding. An attacker capable of influencing sheet names can inject an event-handler attr...
CVE-2025-48129
🚨 CVE-2025-48129 - Privilege Escalation in WordPress Spreadsheet Price Changer Plugin 🛡️ Vulnerability Summary Plugin Affected : Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Vulnerable Versions : Classified under: OWASP A7 – Identification and Authentication Failures 🧪...
xlsx
SheetJS The SheetJS Community Edition offers battle-tested open-source solutions for extracting useful data from almost any complex spreadsheet and generating new spreadsheets that will work with legacy and modern software alike. SheetJS Pro offers solutions beyond data processing: Edit complex...
CVE-2026-108563: Revive Adserver: Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an…
Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet...
CVE-2024-53924
CVE-2024-53924 Description: Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring. Author: Adham Elmosalamy @aelmo Date of Disclosure: November 23, 2024...
CVE-2026-121433
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
EUVD-2026-115855
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
SUSE CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as 100, ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the...
CLEANSTART-2023-OB35220 Spreadsheet::ParseExcel version 0
Security vulnerability affects the perl-spreadsheet-parseexcel package. Spreadsheet::ParseExcel version 0...
CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as 100, ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the...
CVE-2026-115943
A flaw was found in Spreadsheet::XLSX. This vulnerability can lead to arbitrary code execution when the library processes a spreadsheet containing crafted number format conditions. The module improperly evaluates workbook-supplied formatting conditions as code during file parsing. An attacker can...
EUVD-2026-113403
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as 100, ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the...
