CVE-2020-36962 — Tendenci 12.3.1 - CSV/ Formula Injection
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can …
Published: 2026-01-28 · CVSS: 5.3 · CVSS 4.0
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7