CVE-2020-22275

Published: Nov 4, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.

Affected (1)

Products: Easyregistrationforms: Easy Registration Forms

Easyregistrationforms

1 product

Easy Registration Forms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Easyregistrationforms Easy Registration Forms	Version 2.0.6

Related CWEs

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (6)

http://uploadboy.com/ty0715vdcii6/886/mp4

Source: cve@mitre.org

ProductThird Party Advisory

https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22275.pdf

Source: cve@mitre.org

ExploitThird Party Advisory

https://filebin.net/30ceikgukh268yyj

Source: cve@mitre.org

ExploitThird Party Advisory

http://uploadboy.com/ty0715vdcii6/886/mp4

Source: af854a3a-2127-422b-91ae-364da2661108

ProductThird Party Advisory

https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22275.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://filebin.net/30ceikgukh268yyj

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.