CVE-2020-36962
Critical · 9.8CVSS
9.8
EPSS
12.2%
Published
Jan 28, 2026
CISA due date
—
The record
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
- CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
- CVE-2026-9852 A CSV injection vulnerability exists in SYS600. CWE-1236
- CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236
- CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to… CWE-1236
- CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain… CWE-1236
- CVE-2026-47705 TypeBot is a chatbot builder tool. CWE-1236
- CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that… CWE-1236