CWE-1236: CSV injection
327 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 327Published CVEs327 of them scored
- 60Last 12 monthspublished in the last year
- 33Critical140 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-124591
Bahleel CsvExporter.php fputcsv csv injection
Bahleel
Medium5.1 - CVE-2026-111038
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Coupa · Coupa Total Spend Management Platform
High7.3 - CVE-2026-116648
Tanium addressed an improper output sanitization vulnerability in Discover.
Tanium · Discover
Medium4.1 - CVE-2026-121433
AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
AzuraCast · AzuraCast
Medium5.1 - CVE-2026-67187
Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
Saturday Drive · Ninja Forms
Medium5.1 - CVE-2026-102799
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
icagenda.com · iCagenda extension for Joomla
Medium5.3 - CVE-2026-116649
Tanium addressed an improper output sanitization vulnerability in Enforce.
Tanium · Enforce
High7.1 - CVE-2026-116647
Tanium addressed an improper output sanitization vulnerability in Comply.
Tanium · Comply
High7.1 - CVE-2026-86020
Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
Part-DB · Part-DB-server
Medium4.6 - CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
espocrm · espocrm
Medium5.4