← Back
CWE-1236

308 CVEs • Abstraction: Base

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

JSON object

Loading...

CVEs (308)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-10255
1Clustercoding
1Blog Master Pro
Nov 21, 2024
May 1, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code...Show more
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.Show less
CVE-2018-10504
1Web Dorado
1Form Maker
Nov 21, 2024
Apr 27, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
CVE-2018-9137
1Open Audit
1Open Audit
Jun 17, 2026
Apr 19, 2018
N/A· v4
6.8 MEDIUM· v3
3.5 LOW· v2
Open-AudIT before 2.2 has CSV Injection.
CVE-2018-8092
1Mautic
1Mautic
Jun 17, 2026
Apr 18, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Mautic before 2.13.0 allows CSV injection.
CVE-2018-9035
1Contact Form 7 To Database Extension Project
1Contact Form 7 To Database Extension
Jun 17, 2026
Apr 4, 2018
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.
CVE-2018-9107
1Acyba
1Acymailing
Jun 17, 2026
Mar 28, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.
CVE-2018-9106
1Acyba
1Acysms
Jun 17, 2026
Mar 28, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.
CVE-2018-7304
1Tiki
1Tiki
Jun 17, 2026
Feb 21, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd...Show more
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.Show less