perl_spreadsheet_excel_rce_poc

ParseExcel security vulnerabilitiy TL;DR: RCE from logic in parsing format strings. Short explanation on the exploit Root cause of the exploitation comes from calling eval to an unvalidated user input in Utility.pm...

CVE-2021-42292

CVE-2021-42292 This package will detect exploits of CVE-2021-42292, a Microsoft Excel local privilege escalation vulnerability, and generate a notice in notice.log for it. https://corelight.com/blog/detecting-cve-2021-42292 Detection Method: This package detects the vulnerability when the...

CVE-2026-86020

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

EUVD-2026-108580

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020

The open-source inventory management system Part-DB (prior to version 2.13.2 ) is vulnerable to a spreadsheet formula injection in its part import/export workflow. An authenticated user with import permissions can upload a CSV file containing formula-prefixed values (e.g., =1+1) into user-control...

Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion

A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. id: CVE-2023-29887 info: name: Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion author: ctflearner severity: high description: | A Local...

PT-2026-121754

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

xlsx

SheetJS The SheetJS Community Edition offers battle-tested open-source solutions for extracting useful data from almost any complex spreadsheet and generating new spreadsheets that will work with legacy and modern software alike. SheetJS Pro offers solutions beyond data processing: Edit complex...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: CSV Injection in Instant Developer Foundation 25.0.9600 – Proof of Concept PoC 📌 Overview This repository contains a Proof of Concept PoC for a CSV Injection Formula Injection vulnerability CVE-2025-60852 affecting applications built with the Instant Developer Foundation framework...

CVE-2025-48129

🚨 CVE-2025-48129 - Privilege Escalation in WordPress Spreadsheet Price Changer Plugin 🛡️ Vulnerability Summary Plugin Affected : Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Vulnerable Versions : Classified under: OWASP A7 – Identification and Authentication Failures 🧪...

CVE-2024-53924

CVE-2024-53924 Description: Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring. Author: Adham Elmosalamy @aelmo Date of Disclosure: November 23, 2024...

Linux Distros Unpatched Vulnerability : CVE-2026-93581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by...

CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

EUVD-2026-98748

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

CVE-2026-107460: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

UBUNTU-CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

PT-2026-110492

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 2026.6.X OTRS Community Edition versions 6.x and earlier Description User-controlled values are not sufficiently neutralized when included in CSV exports. Data submitted by authenticated users or received via extern...