CVE-2026-102799
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 28 oct 2026 · Última mod.: 28 oct 2026 · CWE-1236
Sin historial EPSS suficiente todavía.
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-671877.1 ALT—
———Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.11hCVE-2026-1166497.1 ALT—
——0Tanium addressed an improper output sanitization vulnerability in Enforce.13hCVE-2026-1166477.1 ALT—
——0Tanium addressed an improper output sanitization vulnerability in Comply.13hCVE-2026-860204.6 MED4.5%
——1Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.5dCVE-2026-551545.4 MED11.1%
——3EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.12dCVE-2026-1093964.2 MED14.0%
——4Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.15d