Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Base Incomplete

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

How to prevent it (3 mitigations)

  1. Implementation

    When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  2. Implementation

    If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  3. Architecture and Design

    Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Source: MITRE CWE-1236

All Critical High Medium Low Exploited only Public exploit

112 results · Clear filters · Feed

  • Medium 6.1
    CVE-2022-46803

    WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.

    Noptin Newsletter Team Simple Newsletter Plugin – Noptin
  • Medium 6.1
    CVE-2022-46809

    WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.

    WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2022-46801

    WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.

    Paul Ryley Site Reviews
  • Medium 6.1
    CVE-2022-46802

    WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.

    WebToffee Product Reviews Import Export for WooCommerce Web / CMS
  • Medium 4.7
    CVE-2023-36527

    WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.

    bestwebsoft Post to CSV by BestWebSoft
  • Medium 4.7
    CVE-2023-23796

    WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.

    Muneeb Form Builder | Create Responsive Contact Forms
  • Medium 4.0
    CVE-2023-23678

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.

    WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
  • Medium 6.1
    CVE-2022-45357

    WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.

    Lenderd 1003 Mortgage Application
  • Medium 4.7
    CVE-2023-22719

    WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

    GiveWP GiveWP
  • Medium 5.8
    CVE-2022-47442

    WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

    AyeCode UsersWP
  • Medium 4.4
    CVE-2023-43071

    Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formul…

    Dell Dell SmartFabric Storage Software
  • Medium 6.8
    CVE-2023-3527

    Avaya Call Management System CSV injection vulnerability

    A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution o…

    Avaya Avaya Call Management System
  • Medium 6.6
    CVE-2023-3302

    Improper Neutralization of Formula Elements in a CSV File in admidio/admidio

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.

    Admidio admidio/admidio admidio/admidio Packagist
  • Medium 5.0
    CVE-2023-2629

    Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 5.4
    CVE-2023-29918 Public exploit

    RosarioSIS vulnerable to CSV Injection

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

    francoisjacquet/rosariosis Packagist
  • Medium 4.4
    CVE-2023-29109

    Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

    The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fie…

    SAP Application Interface Framework (Message Dashboard)
  • Medium 4.0
    CVE-2023-25611

    A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.…

    Fortinet FortiAnalyzer Network devices
  • Medium 5.5
    CVE-2022-35281

    IBM Maximo Application Suite command injection

    IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.

    IBM Maximo Asset Management Maximo Manage
  • Medium 6.3
    CVE-2022-37786

    An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resource…

  • Medium 5.8
    CVE-2022-4034

    Appointment Hour Booking <= 1.3.72 - CSV Injection

    The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported …

    codepeople Appointment Hour Booking – Booking Calendar Web / CMS
  • Medium 6.8
    CVE-2022-41791

    WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

    Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

    Profilegrid ProfileGrid (WordPress plugin) Web / CMS
  • Medium 6.6
    CVE-2022-37905

    Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…

    Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
  • Medium 6.2
    CVE-2022-38061

    WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

    Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.

    apasionados Export Post Info (WordPress plugin) Web / CMS
  • Medium 5.8
    CVE-2022-39217

    Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

    some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an …

    some-natalie ghas-to-csv some-natalie/ghas-to-csv GitHub Actions
  • Medium 6.5
    CVE-2022-3026

    WP Users Exporter <= 1.4.2 - CSV Injection

    The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profi…

    leogermani WP Users Exporter Web / CMS
  • Medium 5.9
    CVE-2022-26867

    PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, wit…

    Dell PowerStore
  • Medium 5.7
    CVE-2021-23286

    Security issues in Eaton Intelligent Power Manager Infrastructure

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0p…

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure)
  • Medium 5.6
    CVE-2021-23654

    Improper Input Validation

    This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a…

    html-to-csv PyPI
  • Medium 6.5
    CVE-2021-41270

    CSV Injection in Symfony

    Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable t…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • Medium 5.9
    CVE-2021-38424

    Delta Electronics DIALink

    The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

    Delta Electronics DIALink ICS / OT
  • Medium 6.5
    CVE-2021-1475

    Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …

    Cisco Cisco Umbrella Insights Virtual Appliance Network devices
  • Medium 6.5
    CVE-2021-1474

    Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …

    Cisco Cisco Umbrella Insights Virtual Appliance Network devices