CVE-2023-53913

None

CVSS

—

EPSS

0.7%

Published

Dec 17, 2025

CISA due date

—

The record

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.

Affected packages

Ecosystem	Package	Introduced	Fixed