Total
323 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-9200 | 1 Huawei | 1 Imanager Neteco 6000 | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device. | |||||
| CVE-2020-9017 | 1 Litecart | 1 Litecart | 2026-06-17 | 6.0 MEDIUM | 8.0 HIGH |
| LiteCart through 2.2.1 allows CSV injection via a customer's profile. | |||||
| CVE-2020-7947 | 1 Auth0 | 1 Login By Auth0 | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded. | |||||
| CVE-2020-7049 | 1 Nozominetworks | 1 Guardian | 2026-06-17 | 8.5 HIGH | 7.3 HIGH |
| Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. | |||||
| CVE-2020-4759 | 1 Ibm | 1 Filenet Content Manager | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736. | |||||
| CVE-2020-4689 | 1 Ibm | 1 Security Guardium | 2026-06-17 | 8.5 HIGH | 6.8 MEDIUM |
| IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696. | |||||
| CVE-2020-4633 | 1 Ibm | 1 Resilient Security Orchestration Automation And Response | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation. | |||||
| CVE-2020-4627 | 1 Ibm | 1 Cloud Pak For Security | 2026-06-17 | 9.0 HIGH | 9.0 CRITICAL |
| IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367. | |||||
| CVE-2020-4302 | 1 Ibm | 1 Cognos Analytics | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 176610. | |||||
| CVE-2020-36941 | 1 Guelfoweb | 1 Knockpy | 2026-06-17 | N/A | 9.8 CRITICAL |
| Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications. | |||||
| CVE-2020-36531 | 1 Ibm | 1 Sevone Network Performance Management | 2026-06-17 | 6.0 MEDIUM | 6.3 MEDIUM |
| A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely. | |||||
| CVE-2020-36503 | 1 Connections-pro | 1 Connections Business Directory | 2026-06-17 | 6.0 MEDIUM | 8.0 HIGH |
| The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue | |||||
| CVE-2020-28845 | 1 Netskope | 1 Netskope | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. | |||||
| CVE-2020-26507 | 1 Marmind | 1 Marmind | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into the “Description” field under the “Insert To-Do” option. Other users might download this data, for example a CSV file, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel. The attacker could gain remote access to the user’s PC. | |||||
| CVE-2020-25445 | 1 Bookingcore | 1 Booking Core | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed. | |||||
| CVE-2020-25398 | 1 Mind | 1 Imind Server | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. | |||||
| CVE-2020-25170 | 1 Bbraun | 1 Onlinesuite Application Package | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export. | |||||
| CVE-2020-24707 | 1 Getgophish | 1 Gophish | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. | |||||
| CVE-2020-22390 | 1 Akaunting | 1 Akaunting | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened. | |||||
| CVE-2020-22278 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents. | |||||