What is the CVSS score of CVE-2020-36962?

CVE-2020-36962 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tendenci are affected by CVE-2020-36962?

Tendenci versions up to 12.3.1 contain a critical vulnerability (CVSS 9.8) that allows attackers to inject malicious formulas into CSV exports, potentially leading to code execution or data…. A patch is available.

Is there a public PoC exploit available for CVE-2020-36962?

Yes, a public proof-of-concept exploit is available for CVE-2020-36962. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2020-36962?

Within 24 hours: Identify all systems running Tendenci versions ≤12.3.1 and restrict CSV export functionality to administrative users only; disable public or unauthenticated CSV generation. Within 7 days: Implement input validation and output encoding controls on all CSV generation functions; audit logs for suspicious CSV export activity and formula injection attempts. Within 30 days: Upgrade to Tendenci 12.4.0 or later once vendor releases patched version; if unavailable, evaluate alternative association management platforms or implement Web Application Firewall rules to block formula injection payloads in CSV responses.

Tendenci CVE-2020-36962

CRITICAL

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-01-28 disclosure@vulncheck.com

Code Injection Tendenci

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 19:13 vuln.today

Public exploit code

CVE Published

Jan 28, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

AnalysisAI

Tendenci 12.3.1 has a CSV formula injection in the contact form message field enabling code execution when administrators export and open data in spreadsheet applications.

Technical ContextAI

Tendenci 12.3.1 fails to sanitize contact form submissions for CSV formula characters (CWE-1236). When administrators export contact data to CSV and open it in Excel, injected formulas execute.