Total
312 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-48709 | 1 Combodo | 1 Itop | 2026-06-17 | N/A | 8.0 HIGH |
| iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0. | |||||
| CVE-2023-48207 | 1 Phpjabbers | 1 Availability Booking Calendar | 2026-06-17 | N/A | 8.8 HIGH |
| Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. | |||||
| CVE-2023-48029 | 1 Corebos | 1 Corebos | 2026-06-17 | N/A | 8.0 HIGH |
| Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer. | |||||
| CVE-2023-47534 | 1 Fortinet | 1 Forticlient Endpoint Management Server | 2026-06-17 | N/A | 9.6 CRITICAL |
| A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets. | |||||
| CVE-2023-47295 | 1 Ncr | 1 Terminal Handler | 2026-06-17 | N/A | 9.8 CRITICAL |
| A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings. | |||||
| CVE-2023-47022 | 1 Ncr | 1 Terminal Handler | 2026-06-17 | N/A | 6.5 MEDIUM |
| Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection. | |||||
| CVE-2023-46401 | 1 Kwhotel | 1 Kwhotel | 2026-06-17 | N/A | 9.8 CRITICAL |
| KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. | |||||
| CVE-2023-46400 | 1 Kwhotel | 1 Kwhotel | 2026-06-17 | N/A | 9.8 CRITICAL |
| KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. | |||||
| CVE-2023-45597 | 1 Ailux | 1 Imx6 | 2026-06-17 | N/A | 5.9 MEDIUM |
| A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerning the function “export_file”) allows a remote authenticated attacker to inject arbitrary formulas inside generated CSV files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. | |||||
| CVE-2023-43071 | 1 Dell | 1 Smartfabric Storage Software | 2026-06-17 | N/A | 4.4 MEDIUM |
| Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to various injection type attacks. | |||||
| CVE-2023-42004 | 1 Ibm | 1 Security Guardium | 2026-06-17 | N/A | 8.0 HIGH |
| IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262. | |||||
| CVE-2023-41798 | 1 Wpwax | 1 Directorist | 2026-06-17 | N/A | 5.1 MEDIUM |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1. | |||||
| CVE-2023-3527 | 1 Avaya | 1 Call Management System | 2026-06-17 | N/A | 6.8 MEDIUM |
| A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel. | |||||
| CVE-2023-3493 | 1 Fossbilling | 1 Fossbilling | 2026-06-17 | N/A | 8.0 HIGH |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3. | |||||
| CVE-2023-3302 | 1 Admidio | 1 Admidio | 2026-06-17 | N/A | 7.8 HIGH |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. | |||||
| CVE-2023-38843 | 1 Atlos | 1 Atlos | 2026-06-17 | N/A | 8.0 HIGH |
| An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function. | |||||
| CVE-2023-37219 | 1 Tadirantele | 1 Aeonix | 2026-06-17 | N/A | 7.3 HIGH |
| Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File | |||||
| CVE-2023-36527 | 1 Bestwebsoft | 1 Post To Csv | 2026-06-17 | N/A | 4.7 MEDIUM |
| Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0. | |||||
| CVE-2023-35899 | 1 Ibm | 1 Cloud Pak For Business Automation | 2026-06-17 | N/A | 7.0 HIGH |
| IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354. | |||||
| CVE-2023-33410 | 1 Minical | 1 Minical | 2026-06-17 | N/A | 8.8 HIGH |
| Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file. | |||||