Common Weakness Enumeration
CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
419 vulnerabilities reference this CWE, most recent first.
GHSA-HM75-8W6H-4F8F
Vulnerability from github – Published: 2023-06-23 15:30 – Updated: 2023-06-30 20:17
VLAI
Summary
Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability
Details
Admidio prior to 4.2.9 is vulnerable toImproper Neutralization of Formula Elements in a CSV File.
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "admidio/admidio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3302"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-23T21:46:18Z",
"nvd_published_at": "2023-06-23T13:15:10Z",
"severity": "HIGH"
},
"details": "Admidio prior to 4.2.9 is vulnerable toImproper Neutralization of Formula Elements in a CSV File.",
"id": "GHSA-hm75-8w6h-4f8f",
"modified": "2023-06-30T20:17:57Z",
"published": "2023-06-23T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3302"
},
{
"type": "WEB",
"url": "https://github.com/admidio/admidio/commit/c87a7074a1a73c4851263060afd76aa4d5b6415f"
},
{
"type": "PACKAGE",
"url": "https://github.com/admidio/admidio"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5e18619f-8379-464a-aad2-65883bb4e81a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability"
}
GHSA-HP3G-5VJ7-7HGC
Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2024-05-20 21:31
VLAI
Details
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-20180"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-09T21:15:00Z",
"severity": "MODERATE"
},
"details": "The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.",
"id": "GHSA-hp3g-5vj7-7hgc",
"modified": "2024-05-20T21:31:09Z",
"published": "2022-05-24T17:05:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20180"
},
{
"type": "WEB",
"url": "https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8"
},
{
"type": "WEB",
"url": "https://medium.com/@Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8"
},
{
"type": "WEB",
"url": "https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/10016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HRFW-PWJG-7PRC
Vulnerability from github – Published: 2023-12-29 06:30 – Updated: 2024-08-27 21:31
VLAI
Details
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-31296"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-29T04:15:09Z",
"severity": "MODERATE"
},
"details": "CSV Injection vulnerability in Sesami Cash Point \u0026 Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.",
"id": "GHSA-hrfw-pwjg-7prc",
"modified": "2024-08-27T21:31:10Z",
"published": "2023-12-29T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31296"
},
{
"type": "WEB",
"url": "https://herolab.usd.de/en/security-advisories/usd-2022-0054"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HVWW-M87W-QFPC
Vulnerability from github – Published: 2025-12-08 12:30 – Updated: 2025-12-08 12:30
VLAI
Details
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-14229"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T11:15:48Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.",
"id": "GHSA-hvww-m87w-qfpc",
"modified": "2025-12-08T12:30:26Z",
"published": "2025-12-08T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14229"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.334671"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.334671"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.702119"
},
{
"type": "WEB",
"url": "https://www.notion.so/Spreadsheet-Formula-Injection-Leading-to-Remote-Code-Execution-in-SourceCodester-Inventory-Managemen-2b723917db8c80dfaaabe2b74d6f283d?source=copy_link"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J569-F347-3CGF
Vulnerability from github – Published: 2023-06-05 21:30 – Updated: 2024-04-04 04:32
VLAI
Details
Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-33410"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-05T21:15:11Z",
"severity": "HIGH"
},
"details": "Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.",
"id": "GHSA-j569-f347-3cgf",
"modified": "2024-04-04T04:32:21Z",
"published": "2023-06-05T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33410"
},
{
"type": "WEB",
"url": "https://github.com/Thirukrishnan/CVE-2023-33410"
},
{
"type": "WEB",
"url": "https://github.com/minical/minical"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5Q7-FP4M-M2WP
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18
VLAI
Details
A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-10258"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-01T19:29:00Z",
"severity": "HIGH"
},
"details": "A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.",
"id": "GHSA-j5q7-fp4m-m2wp",
"modified": "2022-05-13T01:18:49Z",
"published": "2022-05-13T01:18:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10258"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44534"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/147362/Shopy-Point-Of-Sale-1.0-CSV-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6CP-32XJ-XR29
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33
VLAI
Details
phpMyAdmin through 5.0.2 allows CSV injection via Export Section
{
"affected": [],
"aliases": [
"CVE-2020-22278"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-04T17:15:00Z",
"severity": "HIGH"
},
"details": "phpMyAdmin through 5.0.2 allows CSV injection via Export Section",
"id": "GHSA-j6cp-32xj-xr29",
"modified": "2022-05-24T17:33:07Z",
"published": "2022-05-24T17:33:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22278"
},
{
"type": "WEB",
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
},
{
"type": "WEB",
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J77H-M5QV-6JF7
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-21 00:00
VLAI
Details
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
Severity
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2022-2798"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T09:15:00Z",
"severity": "HIGH"
},
"details": "The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data",
"id": "GHSA-j77h-m5qv-6jf7",
"modified": "2022-09-21T00:00:46Z",
"published": "2022-09-17T00:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2798"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JG4Q-MPRJ-P635
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05
VLAI
Details
Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.
{
"affected": [],
"aliases": [
"CVE-2020-22390"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-21T15:15:00Z",
"severity": "HIGH"
},
"details": "Akaunting \u003c= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.",
"id": "GHSA-jg4q-mprj-p635",
"modified": "2022-05-24T19:05:45Z",
"published": "2022-05-24T19:05:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22390"
},
{
"type": "WEB",
"url": "https://cqinfo.la/csv-injection-in-akaunting"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JMM5-HJQM-WQ94
Vulnerability from github – Published: 2024-05-01 18:30 – Updated: 2024-05-01 18:30
VLAI
Details
IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-28764"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T17:15:31Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623.",
"id": "GHSA-jmm5-hjqm-wq94",
"modified": "2024-05-01T18:30:41Z",
"published": "2024-05-01T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28764"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/285623"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7149857"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.