CVE-2023-53913 — Rukovoditel 3.3.1 CSV Injection via User Account Export
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like…
Published: 2025-12-17 · CVSS: 6.2 · CVSS 4.0
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7