CWE-1236

Improper Neutralization of Formula Elements in a CSV File

22 CVEs Avg CVSS 6.9 MITRE
8
CRITICAL
3
HIGH
8
MEDIUM
3
LOW
6
POC
0
KEV

Monthly

CVE-2026-24447 MEDIUM This Month

Malformed data processed by the affected product can be embedded in exported CSV files, which execute arbitrary code when opened by users due to improper input validation. Movable Type 7 and 8.4 series (both EOL) along with current versions are vulnerable to this code injection attack through user-initiated file downloads. An authenticated attacker can craft malicious input to compromise any user who downloads and opens the resulting CSV file.

Code Injection
NVD
CVSS 3.0
6.5
EPSS
0.0%
CVE-2025-67851 MEDIUM PATCH This Month

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. [CVSS 6.1 MEDIUM]

Moodle
NVD
CVSS 3.1
6.1
EPSS
0.0%
CVE-2020-36962 CRITICAL POC Act Now

Tendenci 12.3.1 has a CSV formula injection in the contact form message field enabling code execution when administrators export and open data in spreadsheet applications.

Code Injection Tendenci
NVD GitHub Exploit-DB
CVSS 3.1
9.8
EPSS
0.3%
CVE-2021-47901 CRITICAL POC Act Now

Dirsearch 0.4.1 has CSV injection in scan reports.

Code Injection
NVD GitHub Exploit-DB
CVSS 3.1
9.8
EPSS
0.1%
CVE-2020-36941 CRITICAL POC Act Now

Knockpy 4.1.1 has CSV injection in subdomain scan exports.

Code Injection
NVD GitHub Exploit-DB VulDB
CVSS 3.1
9.8
EPSS
0.1%
CVE-2026-23873 CRITICAL POC Act Now

HUSTOJ online judge system has a CSV injection vulnerability in all versions that allows code execution through crafted submissions exported to spreadsheets.

Linux PHP MySQL Hustoj
NVD GitHub
CVSS 3.1
9.0
EPSS
0.0%
CVE-2025-61873 LOW Monitor

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. [CVSS 2.6 LOW]

Code Injection
NVD
CVSS 3.1
2.6
EPSS
0.0%
CVE-2025-51735 HIGH This Week

CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Unica
NVD GitHub
CVSS 3.1
7.5
EPSS
0.1%
CVE-2025-13133 MEDIUM This Month

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WordPress RCE PHP
NVD
CVSS 3.1
6.6
EPSS
0.1%
CVE-2025-35033 MEDIUM This Month

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Enterprise Health
NVD
CVSS 4.0
6.3
EPSS
0.0%
CVE-2026-24447
EPSS 0% CVSS 6.5
MEDIUM This Month

Malformed data processed by the affected product can be embedded in exported CSV files, which execute arbitrary code when opened by users due to improper input validation. Movable Type 7 and 8.4 series (both EOL) along with current versions are vulnerable to this code injection attack through user-initiated file downloads. An authenticated attacker can craft malicious input to compromise any user who downloads and opens the resulting CSV file.

Code Injection
NVD
CVE-2025-67851
EPSS 0% CVSS 6.1
MEDIUM PATCH This Month

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. [CVSS 6.1 MEDIUM]

Moodle
NVD
CVE-2020-36962
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

Tendenci 12.3.1 has a CSV formula injection in the contact form message field enabling code execution when administrators export and open data in spreadsheet applications.

Code Injection Tendenci
NVD GitHub Exploit-DB
CVE-2021-47901
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

Dirsearch 0.4.1 has CSV injection in scan reports.

Code Injection
NVD GitHub Exploit-DB
CVE-2020-36941
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

Knockpy 4.1.1 has CSV injection in subdomain scan exports.

Code Injection
NVD GitHub Exploit-DB VulDB
CVE-2026-23873
EPSS 0% CVSS 9.0
CRITICAL POC Act Now

HUSTOJ online judge system has a CSV injection vulnerability in all versions that allows code execution through crafted submissions exported to spreadsheets.

Linux PHP MySQL +1
NVD GitHub
CVE-2025-61873
EPSS 0% CVSS 2.6
LOW Monitor

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. [CVSS 2.6 LOW]

Code Injection
NVD
CVE-2025-51735
EPSS 0% CVSS 7.5
HIGH This Week

CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Unica
NVD GitHub
CVE-2025-13133
EPSS 0% CVSS 6.6
MEDIUM This Month

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WordPress RCE PHP
NVD
CVE-2025-35033
EPSS 0% CVSS 6.3
MEDIUM This Month

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Enterprise Health
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy