EUVD-2026-76058
GHSA-2w9g-fhjg-9xh3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv attacker (PR:L), victim must open exported CSV (UI:R), scope changes to victim's spreadsheet context (S:C), low C and I impacts.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.
AnalysisAI
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites must be satisfied: first, the attacker must hold a valid authenticated low-privilege account on the AVideo instance with permission to post comments (PR:L); second, a privileged user - specifically an administrator or video owner - must deliberately download and open the CSV export from myComments.download.php in a spreadsheet application that evaluates formula syntax (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) correctly frames this as a medium-severity issue: attack complexity is low but exploitation is not automatable because it requires both a valid low-privilege account (PR:L) and deliberate victim interaction (UI:P) to open the exported CSV in a spreadsheet application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WWBN AVideo to a commit beyond c3edcc274c389816d434acadac07ee78eaf330c1 as directed by GitHub security advisory GHSA-766f-9gfh-v4wj (https://github.com/WWBN/AVideo/security/advisories/GHSA-766f-9gfh-v4wj); an exact fixed version number is not specified in the available data and should be confirmed against that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today