ByteOS Network

Vulnerability Details :

CVE-2019-12134

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-06 Jun, 2019 | 13:27

Updated At-04 Aug, 2024 | 23:10

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:06 Jun, 2019 | 13:27

Updated At:04 Aug, 2024 | 23:10

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html	x_refsource_MISC

Hyperlink: https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html	x_refsource_MISC x_transferred

Hyperlink: https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:06 Jun, 2019 | 14:29

Updated At:24 Aug, 2020 | 17:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

workday>>workday>>Versions up to 32.0(inclusive)

cpe:2.3:a:workday:workday:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-1236	Primary	nvd@nist.gov

CWE ID: CWE-1236

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html	cve@mitre.org	Third Party Advisory

Hyperlink: https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html

Source: cve@mitre.org

Resource:

Third Party Advisory

Similar CVEs

10Records found

CVE-2019-16120

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-3.00% / 86.05%

7 Day CHG~0.00%

Published-08 Sep, 2019 | 22:48

Updated-07 Feb, 2025 | 19:43

CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.

Vendor-n/a Modern Tribe Inc.Liquid Web, LLC

Product-event_tickets n/a

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2025-9241

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.05% / 14.61%

7 Day CHG~0.00%

Published-20 Aug, 2025 | 19:32

Updated-22 Aug, 2025 | 18:09

elunez eladmin exportUser csv injection

A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Vendor-elunez

Product-eladmin

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2021-37702

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-8||HIGH

EPSS-0.03% / 6.64%

7 Day CHG~0.00%

Published-18 Aug, 2021 | 14:45

Updated-04 Aug, 2024 | 01:23

Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

Vendor-Pimcore

Product-pimcore pimcore

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2018-7304

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.47% / 63.82%

7 Day CHG~0.00%

Published-21 Feb, 2018 | 20:00

Updated-16 Sep, 2024 | 17:57

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.

Vendor-tiki n/a

Product-tiki n/a

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2018-10255

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-2.60% / 85.03%

7 Day CHG~0.00%

Published-01 May, 2018 | 19:00

Updated-05 Aug, 2024 | 07:32

A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

Vendor-clustercoding n/a

Product-blog_master_pro n/a

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2018-10258

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-2.75% / 85.42%

7 Day CHG~0.00%

Published-01 May, 2018 | 19:00

Updated-05 Aug, 2024 | 07:32

A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

Vendor-codeslab n/a

Product-shopy_point_of_sale n/a

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2018-10257

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.78% / 72.77%

7 Day CHG~0.00%

Published-01 May, 2018 | 19:00

Updated-05 Aug, 2024 | 07:32

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

Vendor-hrsale_project n/a

Product-hrsale n/a

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2022-22689

Matching Score-4

Assigner-CA Technologies - A Broadcom Company

View Details

Matching Score-4

Assigner-CA Technologies - A Broadcom Company

CVSS Score-8.8||HIGH

EPSS-2.28% / 84.00%

7 Day CHG~0.00%

Published-04 Feb, 2022 | 22:29

Updated-03 Aug, 2024 | 03:21

CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.

Vendor-n/a Broadcom Inc.

Product-ca_harvest_software_change_manager CA Harvest Software Change Manager

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2023-4006

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

View Details

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-8.8||HIGH

EPSS-0.11% / 30.51%

7 Day CHG~0.00%

Published-31 Jul, 2023 | 00:00

Updated-11 Oct, 2024 | 19:41

Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq

Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.

Vendor-Thorsten Rinne (phpMyFAQ)

Product-phpmyfaq thorsten/phpmyfaq phpmyfaq

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2021-21302

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.47% / 63.59%

7 Day CHG~0.00%

Published-26 Feb, 2021 | 19:45

Updated-03 Aug, 2024 | 18:09

CSV Injection via csv export

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2

Vendor-PrestaShop S.A

Product-prestashop PrestaShop

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE ID-CWE-1236

Improper Neutralization of Formula Elements in a CSV File

CVE-2019-12134

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs