CWE-1236— Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.— MITRE CWE catalog

335 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1236page 5 of 7

CVE-2019-14352HIGHCVSS 7.8EG 7.8
2019-07-28
In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the re…
CVE-2019-11819HIGHCVSS 7.8EG 7.8
2019-05-08
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
CVE-2018-16275HIGHCVSS 7.8EG 7.8
2018-08-31
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
CVE-2018-11526HIGHCVSS 7.8EG 7.8
2018-06-19
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
CVE-2018-11525HIGHCVSS 7.8EG 7.8
2018-06-19
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
CVE-2018-10504HIGHCVSS 7.8EG 7.8
2018-04-27
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
CVE-2022-4034HIGHCVSS 5.8EG 7.8
2022-11-29
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation t…
CVE-2024-22063HIGHCVSS 7.6EG 7.6
2024-12-30
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devic…
CVE-2024-3232HIGHCVSS 7.6EG 7.6
2024-07-16
A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV…
CVE-2025-51735HIGHCVSS 7.5EG 7.5
2025-11-28
CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.
CVE-2025-9241HIGHCVSS 7.5EG 7.5
2025-08-20
A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be …
CVE-2023-31295HIGHCVSS 7.5EG 7.5
2023-12-29
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.
CVE-2023-31294HIGHCVSS 7.5EG 7.5
2023-12-29
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.
CVE-2023-5527HIGHCVSS 7.4EG 7.4
2024-06-18
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to…
CVE-2026-55452HIGHCVSS 7.3EG 7.3
2026-07-10
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escapin…
CVE-2025-66834HIGHCVSS 7.3EG 7.3
2025-12-30
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
CVE-2023-37219HIGHCVSS 7.3EG 7.3
2023-07-30
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CVE-2021-22771HIGHCVSS 7.3EG 7.3
2021-07-21
A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbitrary command execution.
CVE-2021-22153HIGHCVSS 7.3EG 7.3
2021-05-13
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run com…
CVE-2020-7049HIGHCVSS 7.3EG 7.3
2020-06-30
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.
CVE-2020-13247HIGHCVSS 7.3EG 7.3
2020-06-24
BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area.
CVE-2019-15092HIGHCVSS 7.3EG 7.3
2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExp…
CVE-2023-25611HIGHCVSS 4.0EG 7.3
2023-03-07
A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet fo…
CVE-2023-31867HIGHCVSS 7.2EG 7.2
2023-06-22
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
CVE-2022-2268HIGHCVSS 7.2EG 7.2
2022-07-04
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary fi…
CVE-2018-16651HIGHCVSS 7.2EG 7.2
2018-09-07
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
CVE-2022-45078HIGHCVSS 5.9EG 7.2
2023-11-07
Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.
CVE-2023-23678HIGHCVSS 4.0EG 7.2
2023-11-07
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.
CVE-2026-67187HIGHCVSS 7.1EG 7.1
2026-10-28
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State…
CVE-2026-116649HIGHCVSS 7.1EG 7.1
2026-10-27
Tanium addressed an improper output sanitization vulnerability in Enforce.
CVE-2026-116647HIGHCVSS 7.1EG 7.1
2026-10-27
Tanium addressed an improper output sanitization vulnerability in Comply.
CVE-2026-65875HIGHCVSS 7.1EG 7.1
2026-08-03
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
CVE-2025-58855HIGHCVSS 7.1EG 7.1
2025-09-05
Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.
CVE-2024-25007HIGHCVSS 7.1EG 7.1
2024-04-04
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosur…
CVE-2023-35899HIGHCVSS 7.0EG 7.0
2024-03-21
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands …
CVE-2023-22877HIGHCVSS 7.0EG 7.0
2023-08-28
IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.
CVE-2023-28958HIGHCVSS 7.0EG 7.0
2023-07-10
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 2517…
CVE-2026-47693MEDIUMCVSS 6.9EG 6.9
2026-06-08
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the usernam…
CVE-2026-9673MEDIUMCVSS 6.8EG 6.8
2026-05-28
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are ope…
CVE-2024-53260MEDIUMCVSS 6.8EG 6.8
2024-11-27
Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and …
CVE-2023-3527MEDIUMCVSS 6.8EG 6.8
2023-07-18
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrar…
CVE-2022-46408MEDIUMCVSS 6.8EG 6.8
2023-06-29
Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or dat…
CVE-2021-37131MEDIUMCVSS 6.8EG 6.8
2021-10-27
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input valida…
CVE-2021-21302MEDIUMCVSS 6.8EG 6.8
2021-02-26
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
CVE-2020-4689MEDIUMCVSS 6.8EG 6.8
2020-10-12
IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696.
CVE-2019-20180MEDIUMCVSS 6.8EG 6.8
2020-01-09
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
CVE-2018-9137MEDIUMCVSS 6.8EG 6.8
2018-04-19
Open-AudIT before 2.2 has CSV Injection.
CVE-2021-36334MEDIUMCVSS 5.9EG 6.8
2021-11-23
Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine
CVE-2025-13133MEDIUMCVSS 6.6EG 6.6
2025-11-18
The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-le…
CVE-2026-86745MEDIUMCVSS 6.5EG 6.5
2026-09-09
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch re…

Map vulnerabilities like CWE-1236 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1236 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →