Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

152 results · page 2 of 4

Jan 23, 2025KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.CVE-2023-46400 · Other software · Kwhotel · reported by MITRECritical 9.8
KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
Product
Kwhotel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jan 14, 2025An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands CVE-2024-47572 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9
An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file
Product
FortiSOAR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com
Oct 29, 2024GRÜN spendino Spendenformular: Missing AuthorizationCVE-2024-50476 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
Product
GRÜN spendino Spendenformular
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update GRÜN spendino Spendenformular to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2024A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate appCVE-2024-3232 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.6
A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
Product
Tenable Identity Exposure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Jul 9, 2024An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to CVE-2024-27785 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
Product
FortiAIOps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com fortiguard.fortinet.com
Jun 8, 2024Formula: Reflected Cross-Site ScriptingCVE-2024-5638 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formula
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Formula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 8, 2024Formula: Reflected Cross-Site ScriptingCVE-2024-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formula
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Formula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Apr 26, 2024CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which caCVE-2024-28328 · Network & remote access · asus · reported by MITREMedium 5.4
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.
Product
rt-n12\+_b1_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 12, 2024A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FCVE-2023-47534 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.6
A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.
Product
FortiClientEMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Mar 5, 2024A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerninCVE-2023-45597 · Other software · AiLux · reported by prodsec@nozominetworks.comMedium 5.9
A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerning the function “export_file”) allows a remote authenticated attacker to inject arbitrary formulas inside generated CSV files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
Product
imx6 bundle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com nozominetworks.com
Jan 30, 2024GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository.CVE-2024-23840 · Other software · goreleaser · reported by GitHubMedium 5.5
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.
Product
goreleaser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Posts and Users Stats: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-44738 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
Product
Posts and Users Stats
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Posts and Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple CSV/XLS Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-42882 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
Product
Simple CSV/XLS Exporter
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Simple CSV/XLS Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data CSV: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-41616 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
Product
Export Users Data CSV
Affected
up to 2.1
What to do
Affects up to 2.1. Update Export Users Data CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP CSV Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Product
WP CSV Exporter
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP CSV Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Product
Emails & Newsletters with Jackmail
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46809 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data Distinct: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46804 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
Product
Export Users Data Distinct
Affected
up to 1.3
What to do
Affects up to 1.3. Update Export Users Data Distinct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple Newsletter Plugin – Noptin: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46803 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.
Product
Simple Newsletter Plugin – Noptin
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Site Reviews: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46801 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Product
Site Reviews
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
Product
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Commenter Emails: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45360 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.
Product
Commenter Emails
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Commenter Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023amr users: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45348 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.
Product
amr users
Affected
up to 4.59.4
What to do
Affects up to 4.59.4. Update amr users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023User Blocker: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45078 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.
Product
User Blocker
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update User Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Post to CSV by BestWebSoft: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-36527 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.
Product
Post to CSV by BestWebSoft
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023KB Support: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-25983 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84.
Product
KB Support
Affected
up to 1.5.84
What to do
Affects up to 1.5.84. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Form Builder | Create Responsive Contact Forms: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23796 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
Product
Form Builder | Create Responsive Contact Forms
Affected
up to 1.9.9.0
What to do
Affects up to 1.9.9.0. Update Form Builder | Create Responsive Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23678 · WordPress plugins & themes · reported by PatchstackMedium 4
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023GiveWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-22719 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Product
GiveWP
Affected
up to 2.25.1
What to do
Affects up to 2.25.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 20231003 Mortgage Application: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45357 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.
Product
1003 Mortgage Application
Affected
up to 1.75
What to do
Affects up to 1.75. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UsersWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-47442 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
Product
UsersWP
Affected
up to 1.2.3.9
What to do
Affects up to 1.2.3.9. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple History – user activity log, audit tool: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45350 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.
Product
Simple History – user activity log, audit tool
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Simple History – user activity log, audit tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to crosCVE-2023-43071 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to various injection type attacks.
Product
Dell SmartFabric Storage Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jul 30, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.CVE-2023-4006 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Product
thorsten/phpmyfaq
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jul 30, 2023 Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-37219 · Other software · Tadiran · reported by cna@cyber.gov.ilHigh 7.3
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Product
Telecom Composit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il gov.il
Jun 30, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.CVE-2023-3493 · Other software · fossbilling · reported by security@huntr.devHigh 8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
Product
fossbilling/fossbilling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jun 23, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3302 · Other software · admidio · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
Product
admidio/admidio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
May 10, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.CVE-2023-2629 · Other software · pimcore · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
Product
pimcore/customer-data-framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Apr 24, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2258 · Other software · alfio-event · reported by security@huntr.devHigh 8.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
Product
alfio-event/alf.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 7, 2023A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows localCVE-2023-25611 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4
A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names.
Product
FortiAnalyzer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Feb 15, 2023An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise SeCVE-2022-45153 · Other software · SUSE · reported by meissner@suse.deHigh 7
An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.
Product
SUSE Linux Enterprise Module for SAP Applications 15-SP1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com bugzilla.suse.com
Feb 8, 2023formula is a math and string formula parser.CVE-2023-25166 · Other software · hapijs · reported by GitHubMedium 5.5
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Product
formula
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 26, 2023A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.CVE-2023-24493 · Other software · Tenable · reported by vulnreport@tenable.comMedium 5.7
A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host.
Product
Tenable.sc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Jun 17, 2022Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-2112 · Other software · inventree · reported by security@huntr.devHigh 8.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
Product
inventree/inventree
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jun 9, 2022Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-2027 · Other software · kromitgmbh · reported by security@huntr.devHigh 8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
Product
kromitgmbh/titra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
May 1, 2022Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1.CVE-2022-1544 · Other software · luyadev · reported by security@huntr.devHigh 7.8
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Product
luyadev/yii-helpers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Apr 18, 2022Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection.CVE-2021-23286 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 5.7
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.
Product
Intelligent Power Manager Infrastructure (IPM Infrastructure)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eaton.com eaton.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.