CWE-1236
CWE-1236 · 4 records · 3 with a public proof-of-concept
Records the NVD classes under CWE-1236, highest CVSS first.
- MEDIUM 6.1CVE-2026-93581
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields…
- MEDIUM 5.4CVE-2026-100564public PoC
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in …
- MEDIUM 5.4CVE-2026-100563public PoC
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust partici…
- MEDIUM 4.2CVE-2026-108579public PoC
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERL…